Business email compromise

What it is

BEC often targets finance, HR, and executives. The message may look like a CEO asking for a quiet wire, a vendor updating banking details, or a lawyer demanding a same-day payment.

Losses can be large because the emails use real threads, lookalike domains, or actual compromised inboxes — and AI writing tools make the grammar cleaner than older scams.

How it works

1. Access or spoof — Phishing, password reuse, or lookalike domains create a believable channel.
2. Recon — Attackers study invoice patterns, vacation schedules, and org charts.
3. Ask — A payment-change, gift-card, or W-2 request arrives with urgency and secrecy.
4. Cash out — Funds move to attacker-controlled accounts, often overseas.
5. Cover — Follow-up emails delay discovery until recovery is harder.
6. Related to spear phishing, account takeover, and AI impersonation.

Red flags

• Last-minute changes to vendor bank details sent only by email
• Executives requesting unusual secrecy around a wire or gift cards
• Slightly off domains (rn vs m) or display names that hide the real address
• Pressure to skip phone verification with the known vendor contact
• Invoice threads suddenly including a new assistant
• MFA fatigue or login alerts on a finance mailbox

What to do if you’re targeted

• **Verify payment changes** out-of-band — call a known number, do not use numbers in the suspicious email.
• **If funds left:** contact your bank's fraud team immediately; file with IC3.gov (U.S.).
• **Secure the mailbox** — password reset, MFA, session revoke, check inbox rules.
• **Warn vendors and staff**; review recent payment instructions.
• **Add process controls** — dual approval for bank-detail changes.
• **Personal spillover:** if your individual identity data was in compromised mail, consider monitoring and a free identity scan.

Related terms

• Spear phishing
• Account takeover
• AI impersonation