Business Email Compromise (BEC)
Americans lost $12.5 billion to fraud in 2024, according to the FTC.
Quick Answer
Business Email Compromise (BEC) is a sophisticated scam that targets businesses and individuals to induce fraudulent fund transfers, resulting in over $2.9 billion in losses in 2023 alone, according to the FBI.
Think you've seen this scam?
Paste any suspicious text, email, or voicemail into our free checker — get a verdict in 5 seconds. Or get our free Scam Defense Playbook.
Free. No credit card. No signup required for the checker.
How It Works
1
A scammer identifies a target organization and gathers information about its employees, executives, and vendors through social media and other online sources.
2
The scammer compromises a legitimate business email account or creates a nearly identical spoofed email address to impersonate a trusted individual, such as a CEO, a colleague in the finance department, or a regular vendor.
3
Posing as the trusted party, the scammer sends an urgent email to an employee, instructing them to make a wire transfer, change payment details for a vendor, or provide sensitive information like W-2 forms.
4
The employee, believing the request is legitimate due to the convincing impersonation and sense of urgency, authorizes the fraudulent transaction, sending funds directly to an account controlled by the scammer.
Red Flags
- Emails requesting urgent wire transfers or payments to new or updated bank accounts.
- Messages from executives that bypass normal procedures or are sent at unusual hours.
- Slight variations in an email address, such as a changed letter or a different domain (e.g., '.co' instead of '.com').
- Requests for absolute secrecy or pressure to act immediately without verification.
- Unusual requests for gift cards, payroll changes, or sensitive company data.
- A change in the tone, language, or grammar used by the supposed sender.
What to Do If Targeted
- If you receive a suspicious email, do not reply, click links, or open attachments.
- Verify all payment requests and changes to vendor information using a different communication method, such as a known phone number.
- Immediately contact your financial institution to request a recall of funds if a fraudulent transfer has been made.
- Secure the compromised email account by changing the password and enabling multi-factor authentication.
- Preserve all original emails and documentation related to the incident for law enforcement.
- Report the incident to your internal IT or security department immediately.
How to Report It
- FBI IC3 — Report the incident to the FBI's Internet Crime Complaint Center (IC3). Acting quickly increases the chances of recovering funds.
- FTC — File a report with the Federal Trade Commission to help them track and combat fraud.
- Local FBI Field Office — Contact your local FBI field office to report the crime directly.
- FCC — File a complaint about phone scams, robocalls, or unwanted calls with the Federal Communications Commission.
- AARP Fraud Helpline — Call 877-908-3360 for free support from trained fraud specialists. Available to anyone, not just AARP members.
Key Statistics
- The FBI's Internet Crime Complaint Center (IC3) received 21,489 Business Email Compromise complaints in 2023, with adjusted losses over $2.9 billion. — FBI IC3 2023 Internet Crime Report
- The average loss per BEC incident in the U.S. increased to $137,132 in 2023. — FBI IC3, reported by Abnormal Security
- Between 2013 and 2023, global exposed losses due to BEC scams reached over $55 billion. — FBI IC3
- BEC was the second-costliest type of crime tracked by the FBI IC3 in 2023, surpassed only by investment fraud. — FBI IC3 2023 Internet Crime Report
- A 2024 survey found that nearly three-quarters (70%) of organizations were targeted by BEC attacks in the last year. — Arctic Wolf 2024 Trends Report
Get scam alerts before they hit your parents' inbox
One email per week. The scam that's spreading right now, the red flags, and what to tell Mom and Dad.
Free forever. Unsubscribe in one click.
Frequently Asked Questions
Business Email Compromise (BEC) is a sophisticated scam targeting both businesses and individuals. Scammers compromise or impersonate legitimate email accounts to trick employees into making unauthorized fund transfers or providing sensitive information.
In 2023, the FBI's Internet Crime Complaint Center (IC3) received 21,489 BEC complaints with adjusted losses over $2.9 billion, making it the second-costliest type of cybercrime. Global exposed losses from BEC have exceeded $55 billion since tracking began.
While both are email-based attacks, phishing is often a widespread campaign using malicious links or attachments to steal credentials. BEC is a highly targeted form of social engineering that typically does not use malware; instead, it relies on impersonation and deception to trick a specific person into authorizing a fraudulent payment.
Act quickly. Immediately contact your financial institution to request a recall of the wire transfer. Then, report the crime to the FBI's Internet Crime Complaint Center at ic3.gov and your local FBI field office to engage the Recovery Asset Team.
Has this scam reached your family?
Ready to protect yourself?
We've vetted the tools that actually work — VPN, threat protection, and identity monitoring.
See our recommended tools →Get weekly scam alerts
One breakdown per week. Real threats. Zero fluff.
You're in! Check your inbox.