Business Email Compromise: How It Works and How to Stop It
Business email compromise (BEC) is a fraud in which criminals impersonate a trusted person, such as a CEO, supplier or lawyer, usually by email, to trick an employee into sending money or sensitive information. It's stopped by combining technical controls (multi-factor authentication, email authentication and phishing filtering) with one firm process rule: every request to pay money or change bank details is verified through a separate, known channel.
Why it matters
BEC is one of the most financially damaging forms of cybercrime. In its 2025 report, the FBI's Internet Crime Complaint Center recorded roughly $3 billion in reported BEC losses in the United States alone, from about 24,800 complaints (Nacha summary of IC3 data; Insurance Business). Reported figures understate the real total, because many victims never report.
BEC works anywhere businesses pay by bank transfer, and it doesn't need malware. It exploits trust, urgency and busy people.
The five common versions
| Type | How it looks |
|---|---|
| Fake supplier invoice | A "supplier" says their bank details have changed and asks you to pay the next invoice to a new account |
| CEO fraud | The "CEO" emails finance asking for an urgent, confidential transfer |
| Compromised account | A real supplier's or colleague's mailbox is hacked and used to send convincing requests inside a genuine email thread |
| Payroll diversion | An "employee" asks HR to change the account their salary is paid into |
| Lawyer or deal impersonation | During a property or business deal, fraudsters pose as the lawyer and send fake completion bank details |
Attackers increasingly use AI to write fluent, personalised messages, and even to clone voices for follow-up calls. Spelling mistakes are no longer a reliable warning sign.
Warning signs
- A change of bank details, especially by email
- Urgency or secrecy ("needs to go today", "don't discuss this with anyone")
- The sender is travelling or unreachable by phone
- A slightly different email domain (e.g.
eleova-co.cominstead ofeleova.com) - Reply-to address different from the sender
- A request that bypasses the normal approval process
How to stop it
Process controls (the most important)
- Call-back rule. Verify any new or changed bank details, and any unusual payment request, by phoning a number you already hold, never one from the email.
- Dual approval for payments above a set threshold.
- A cooling-off period for paying newly added or changed beneficiary accounts.
- Make it safe to challenge. Staff should never be penalised for delaying a payment to verify a request, even one that appears to come from the CEO.
Technical controls
- Multi-factor authentication on every mailbox, to prevent account takeover.
- SPF, DKIM and DMARC on your domain (with DMARC moving toward
reject) to stop direct spoofing. - External email banners that flag messages from outside the organisation.
- Lookalike-domain monitoring.
- Alerts on suspicious mailbox rules, such as forwarding or auto-delete rules that attackers create to hide their activity.
Training
- Short, regular awareness sessions using real BEC examples, including AI-generated messages and voice calls.
If you've been targeted
- Call your bank immediately and request a recall of the transfer. Speed is everything.
- Reset passwords and review mailbox rules on any account that may be compromised.
- Preserve the emails and headers as evidence.
- Report it to the police and the relevant authority. In Nigeria, check whether you have duties to report to ngCERT or, if personal data was exposed, to the NDPC within 72 hours.
- Warn customers or suppliers if your account was used to target them.
Frequently asked questions
What is the difference between phishing and business email compromise?
Phishing is a broad term for deceptive messages that try to steal credentials or install malware. BEC is a specific type of targeted fraud that impersonates a trusted person to get money or data, often without any link or attachment.
Can banks recover money lost to BEC?
Sometimes, if the bank is told quickly enough to freeze the receiving account. Recovery chances fall sharply after the first day or two, which is why immediate reporting matters.
Does DMARC stop business email compromise?
DMARC stops criminals from sending emails that appear to come from your exact domain. It doesn't stop lookalike domains or attacks from a genuinely compromised account, so it must be combined with MFA and verification procedures.
Close the gaps before someone finds them
We help businesses put the process and technical controls in place. Strengthen your digital security →