Ask most business owners which cyberattack worries them most and they’ll say ransomware. But the attack that quietly takes the most money often doesn’t touch a single file. It’s business email compromise (BEC): one convincing email, one changed bank account, one payment that never comes back.
What is business email compromise?
Business email compromise is fraud by email. A criminal poses as someone you trust, such as the CEO, a supplier, a lawyer or a colleague in finance, and asks for a payment, a change of bank details, gift cards or sensitive information.
There are two main versions:
- Impersonation. The email comes from a lookalike domain, with one letter swapped or a word added, or from a personal webmail address using a real person’s name.
- Account takeover. The attacker has actually broken into a real mailbox, often with a phished password, and sends the request from the genuine account. This is far harder to spot, because everything about the email is real except the person typing it.
Often there is no link, no attachment and no malware. Just a request. That’s why the filters built into Microsoft 365 and Google Workspace, which look for dangerous content, regularly let BEC through.
How big is the problem?
- BEC cost US victims $3.05 billion in 2025, the second-largest loss category the FBI tracks, behind only investment fraud. (FBI IC3 2025 Internet Crime Report)
- BEC and funds transfer fraud made up 58% of cyber-insurance claims in 2025. (Coalition 2026 Cyber Claims Report)
- 52% of funds transfer fraud claims started as a BEC, and the average funds transfer fraud loss was $141,000. (Coalition 2026 Cyber Claims Report)
- BEC claims became 15% more frequent in 2025, even as the average BEC loss fell to $27,000. (Coalition 2026 Cyber Claims Report)
For a small business, a single $141,000 wire can be a month’s payroll or more.
Real BEC attack examples
Fake invoices to two of the largest US tech companies. Between 2013 and 2015, a Lithuanian man registered a company with the same name as a real Asian hardware maker, then emailed fake invoices to two major US internet companies that genuinely did business with that supplier. He backed them up with forged contracts and letters. The companies paid more than $120 million before it was caught. He was sentenced to five years in prison. (US Department of Justice, Southern District of New York)
A changed bank account at a car-parts maker. In August 2019, a European subsidiary of Toyota Boshoku acted on fraudulent payment instructions and lost about 4 billion yen, roughly $37 million, in a single transfer. (Toyota Boshoku announcement, September 2019)
Both companies had large finance teams and formal controls. The emails still worked, because they asked for something that looked like normal business.
A worked example: how BEC plays out at a small business
This is an illustrative example, not a real client. A 15-person construction firm pays several suppliers by bank transfer every month.
- The password. The office manager gets a “shared document” email and types her Microsoft 365 password into a fake sign-in page. (This is AiTM phishing, which gets past most MFA. If it has already happened, follow our first-hour checklist for a compromised Microsoft 365 account.)
- The quiet setup. The attacker signs in from abroad and adds an inbox rule: any email containing “invoice” or “payment” skips her inbox and goes to an archive folder she never opens.
- The watching. For two weeks they read her mail and learn which supplier is owed a large payment, and when.
- The ask. They register a lookalike of the supplier’s domain and email her: “We’ve changed banks. Please use the new details below for this month’s invoice.” Replies go to the lookalike address, not the real supplier.
- The wire. She updates the details and pays. The real supplier calls three weeks later asking where their money is.
Every step left a trace: an odd sign-in, a new inbox rule, a domain registered days earlier, and a request to change bank details. None of them involved malware.
Warning signs of a BEC email
- A request to change bank details, especially by email only, or “just for this invoice”.
- Urgency and secrecy: “I’m in a meeting, can you handle this now and keep it between us?”
- A sender address that’s almost right, or a real name on a personal webmail address.
- Replies that go somewhere else. The reply-to address differs from the sender.
- A change in tone from someone you know: longer, more formal, or more rushed than usual.
- Gift card requests from the boss. No real CEO needs gift cards bought urgently by email.
And on the account side, the signs of a mailbox that’s been taken over:
- New inbox rules that move, delete or forward mail, especially messages about invoices or payments.
- Sign-ins from unusual places or devices for that person.
- Sent emails the person doesn’t remember sending.
How to stop BEC: a checklist
Payment process (the cheapest control, and the one that works best):
- Any change of bank details is confirmed by phone, using a number you already have, never one from the email.
- Payments above a set amount need a second person to approve.
- New suppliers are set up with a call, not just an email.
Email:
- Lookalike domains and display-name impersonation are flagged, not just dangerous links.
- Requests with no link at all, like payment changes and gift cards, are checked against the sender’s normal behaviour.
- Your own domain has SPF, DKIM and DMARC set up, so others can’t send mail that looks like it’s from you.
Accounts:
- MFA is on for every mailbox, with phishing-resistant methods for finance and admin accounts.
- New inbox rules and forwarding to outside addresses raise an alert.
- Unusual sign-ins are reviewed quickly, not at the end of the month.
People:
- Finance staff know the one rule: bank details change by phone call, never by email alone.
What to do if you’ve paid a BEC scammer
- Call your bank immediately and ask them to recall the payment. Speed matters more than anything else here.
- Report it to the FBI at ic3.gov the same day. The sooner it’s reported, the better the chance the money can still be frozen.
- Lock down the mailbox. Reset the password, end every active session, remove inbox rules and forwarding, and check for MFA methods the attacker added.
- Warn the supplier or client whose name was used, and check whether others got the same email.
- Call your cyber insurer. BEC and funds transfer fraud are among the most common claims they handle.
How Centeye helps
Centeye Lighthouse reads mail in Microsoft 365 and Gmail after it arrives. It spots lookalike domains, a colleague’s or CEO’s name on an outside address, requests to change bank details, and urgent favours that don’t fit the sender’s history, then quarantines the message and pulls every copy from every inbox.
If someone already gave away their password, Centeye Gatewatch catches the odd sign-in and the hidden inbox rule set straight after, ends the attacker’s sessions and removes the rule at your setting. Praxis joins the email, the sign-in and the rule into one case, so the construction-firm attack above shows up as one story before the money moves.
Want the plain-English version of these terms? See BEC in our security glossary, read how to protect a business from ransomware, or read how MFA fatigue attacks get past MFA. Ready to see it on your own tenants? Start a free trial.
Frequently asked questions
What is a BEC attack in simple terms?
It’s when a criminal pretends to be someone you trust over email, such as your boss or a supplier, to get you to send money or information. There’s usually no virus, just a believable request.
What is the most common type of business email compromise?
Fake payment requests and changed bank details for real invoices are the most costly. Over half of funds transfer fraud claims in 2025 started as a BEC. (Coalition 2026 Cyber Claims Report)
Can MFA stop BEC?
MFA makes it much harder for an attacker to take over a mailbox, so it stops many BEC attacks that rely on a stolen password. It doesn’t help when the attacker simply sends from a lookalike domain, which is why payment checks and email checks are still needed.
Can you get money back after a BEC scam?
Sometimes, if you act fast. Call your bank straight away and report it at ic3.gov. Recovery gets much harder once the money has moved on from the first account.
Is BEC the same as phishing?
BEC is a type of phishing. Most phishing tries to steal a password or install malware. BEC goes straight for the money, usually by asking for a payment or a change of bank details.
Figures cited from the FBI IC3 2025 Internet Crime Report, the Coalition 2026 Cyber Claims Report, US Department of Justice (Southern District of New York) case releases, and Toyota Boshoku’s September 2019 announcement. The worked example is illustrative. Centeye describes only capabilities that ship in the product today.