Business email compromise (BEC) is when a criminal takes over or imitates a business email account to steer payments or sensitive data. It needs no malware, and the emails often come from real accounts, so filters can miss them. People are the last line of defense. These are the signs to watch for.
Changed payment details
The classic sign is a request to change where money goes: new bank details for a vendor, a different account for payroll, updated wire instructions before a closing. The email may come from a real vendor address and reference a real invoice.
What to do: never act on payment changes from email alone. Call the person using a phone number you already have, not one in the message, and confirm.
Urgency and secrecy
Attackers rush people so they do not stop to check.
- “This has to go out today or we lose the deal.”
- “Keep this confidential until the announcement.”
- “I’m in meetings all day, just process it.”
A request that combines money, urgency and a reason not to verify is a red flag, even from the CEO.
Hidden mailbox rules
After a takeover, attackers often create inbox rules that hide replies, delete warnings or forward mail to an outside address. Signs include:
- Replies to your emails that you never see.
- Contacts asking about messages you did not send.
- Missing emails from a particular vendor or client.
Unusual sign-ins
Account activity tells the story:
- Sign-in alerts from countries or cities you have not visited.
- Prompts to approve a sign-in you did not start.
- Being signed out unexpectedly, or a password that suddenly stops working.
Never approve an MFA prompt you did not request.
Lookalike addresses
Imitation attacks use addresses that are almost right: an extra letter, a swapped character or a different domain ending. Check the full address, not just the display name.
How common it is
Business email compromise is one of the most expensive crimes reported to the FBI. In its 2024 report, the FBI’s Internet Crime Complaint Center counted more than 21,000 BEC complaints with reported losses of about $2.8 billion, and many cases are never reported. Small and mid-size businesses are frequent targets because they move real money with fewer approval steps than large companies.
The most common scenarios
Most attacks follow a handful of scripts. Knowing them makes the next one easier to spot.
- Vendor invoice fraud. A supplier’s mailbox is taken over, and the attacker replies inside a real invoice thread with “updated” bank details.
- Payroll diversion. HR receives a polite note from an employee asking to change their direct deposit account before the next payday.
- Real estate and closing fraud. A buyer gets wiring instructions that look like they came from the title company or attorney, days before closing.
- Executive impersonation. A message that appears to come from the owner asks someone to buy gift cards or send a quick wire while the owner is traveling.
- Data theft. Someone posing as an executive asks for employee tax forms or a customer list, which is later used for identity fraud.
Why MFA alone is not enough
Multi-factor authentication blocks most password attacks, but criminals have adapted. Some phishing pages sit between the user and the real sign-in page and capture the session after MFA is completed. Others send a stream of approval prompts until someone taps yes to make them stop. Some trick users into granting a malicious app permission to read their mail, with no password needed at all.
The defenses are layered:
- Use number matching or phishing-resistant methods such as passkeys and security keys, especially for finance staff and executives.
- Limit which apps users can approve on their own, and review app permissions regularly.
- Watch for sign-ins from new devices and locations, and revoke sessions quickly when something looks wrong.
Build a payment verification habit
Technology catches a lot, but the strongest protection is a rule everyone follows.
- Write down a payment change procedure: any new or changed bank details must be confirmed by phone using a number already on file.
- Require a second person to approve wires and new vendors above an amount you choose.
- Treat urgency as a reason to slow down, not speed up.
- Ask your bank about positive pay and alerts for new payees.
- Tell customers and vendors how you will and will not ask for payment, so they can spot a fake too.
Training that sticks
Annual slide decks do not change habits. Short, regular phishing simulations and quick refreshers tied to real examples work better. The goal is a culture where reporting a suspicious message is praised, even when it turns out to be harmless, and where nobody is embarrassed to call and check.
What your IT provider should be watching
A managed IT provider should alert on the signs this guide describes: new inbox rules, forwarding to outside addresses, unusual sign-ins, new MFA methods and sudden spikes in sent mail. Ask how those alerts are reviewed, who acts on them and how quickly an account can be locked during office hours.
Protect the people who pay you
Criminals also impersonate your business to your customers. If a client wires money to a fake account because of an email that looked like yours, the relationship suffers even if your systems were never touched. A few steps help:
- Publish email authentication records (SPF, DKIM and DMARC) so receiving mail systems can reject messages that pretend to come from your domain.
- Put a short note on invoices and in your email signature explaining that your bank details will never change by email.
- Register lookalike versions of your domain that are easy to confuse with yours, or at least watch for new ones.
- When a customer calls to confirm payment details, thank them and make sure your staff know the right answer.
Keep the evidence
When you suspect compromise, the instinct is to delete the bad message and move on. Resist it. The original email, its full headers, the mailbox rules the attacker created and the sign-in logs are what your IT provider, your bank, your insurer and law enforcement need. Forward suspicious messages to your IT provider as attachments rather than deleting them, write down when you noticed the problem and what you did, and keep any bank confirmation numbers. Good records also help if you need to notify customers or file an insurance claim later.
What to do in the first hour
- Do not reply to the suspicious message or click its links.
- Call your IT provider. Our clients call us during office hours, and an engineer locks the account, ends sessions and removes bad rules.
- Reset the password and check MFA settings.
- If money moved, call your bank immediately and ask for a recall.
- Report the incident to the FBI’s Internet Crime Complaint Center.
- Warn contacts who may have received fraudulent messages.
Read about our email compromise protection.