Business email compromise (BEC) is a cybercrime tactic where attackers forge emails to impersonate executives, vendors, or partners, tricking employees into transferring funds or sharing sensitive data. These attacks exploit trust in email communication rather than technical vulnerabilities.
BEC is not a single attack vector but a category of social engineering scams. The FBI reports BEC losses exceeded $2.7 billion in 2022 alone, with average individual losses above $100,000. Unlike broad phishing campaigns, BEC targets specific individuals within organizations using detailed reconnaissance.
Attackers often spend days monitoring corporate email traffic to mimic writing styles, identify payment procedures, and time requests during low-visibility hours. They may spoof sender addresses using similar domains (e.g., "[email protected]" vs. "[email protected]") or hijack existing accounts through credential theft.
Successful BEC attacks follow a predictable sequence. First, attackers gather intelligence-often from public sources like LinkedIn, company websites, or press releases-to build profiles of key personnel. A CFO's recent travel announcement, for example, might signal reduced availability and increase window for deception.
Next, they craft messages that mirror internal communication patterns. An attacker posing as a CEO might send a request like: "I'm traveling and need you to process a $50,000 vendor payment urgently. Please confirm once completed." The urgency and authority create pressure to act quickly without verification.
Once funds are transferred, attackers move quickly to launder money through multiple accounts or cryptocurrency. In one documented case, a U.S.-based tech firm lost $1.2 million after an employee wired funds to a fraudulent account after receiving a spoofed email from a fake "executive team" address.
BEC attacks fall into several categories based on the impostor role and goal. The most frequent involve impersonation of executives, vendors, or IT support.
| Type | Impersonated Role | Goal | Example |
|---|---|---|---|
| Executive Impersonation | CEO, CFO, or director | Funds transfer | "Wire $75K to vendor X by EOD." |
| Vendor Impersonation | Supplier or service provider | Change payment details | "Update our bank info-new account effective now." |
| IT Support Impersonation | Internal IT or helpdesk | Phishing for credentials | "Your password expired. Click here to reset." |
| Legal/HR Impersonation | Lawyer or HR manager | Data theft or payroll fraud | "Send employee W-2 forms for tax filing." |
A lesser-known but growing variant involves "account takeover," where attackers gain access to legitimate employee accounts via stolen passwords or malware. Once inside, they send messages from real inboxes, making detection harder. The 2021 SolarWinds breach demonstrated how compromised credentials can enable long-term BEC activity undetected.
Attackers also use domain spoofing with slight typos in email addresses (e.g., "[email protected]" instead of "company.com"). These errors are often missed by users under time pressure, especially in high-volume departments like finance or procurement.
BEC thrives in environments with weak internal controls around financial transactions and limited employee training on email security. Small and medium-sized businesses are disproportionately affected-62% of BEC victims in 2023 were companies with fewer than 500 employees, according to the FBI's Internet Crime Complaint Center (IC3).
These attacks succeed because they bypass traditional antivirus and firewall defenses. Instead of exploiting software flaws, they manipulate human behavior. A 2022 study by Proofpoint found that 91% of successful BEC attempts involved some form of psychological manipulation, such as urgency, fear of consequences, or authority pressure.
High-value targets include finance teams, HR departments, and procurement officers-roles frequently tasked with handling payments or sensitive data. Attackers often choose times when leadership is unavailable, such as weekends or holidays, to reduce scrutiny.
BEC is often mistaken for general phishing or ransomware, but the differences are critical. Phishing typically sends mass emails with generic content ("Your account will be suspended") and relies on broad targeting. BEC is highly personalized and focused on specific individuals or roles.
Ransomware encrypts files and demands payment for decryption. BEC does not alter systems-it steals money or data through deception. While both result in financial loss, their mechanisms differ: ransomware uses technical encryption; BEC uses psychological manipulation.
A key distinction is intent. BEC aims to extract value without disruption. The attacker wants the victim to believe the email is real and comply-then disappear. Ransomware seeks control. This difference affects response strategies: BEC requires policy changes and verification protocols; ransomware demands endpoint protection and recovery plans.
In 2020, a mid-sized construction company received an email from its "CEO" requesting a wire transfer of $450,000 to a new subcontractor. The message used the executive's actual signature and referenced a recent board meeting. The finance team processed the transfer within 15 minutes.
After the funds disappeared, the company discovered the email came from a forged address using a domain nearly identical to the real one. The attacker had accessed the executive's calendar and email history to time the request during a known vacation period. The incident cost the company over $600,000 in losses and legal fees.
Prevention begins with layered controls. Require dual approval for transfers over $10,000. Train staff to verify urgent requests via phone or video call-even if the sender appears legitimate. Enable DMARC, SPF, and DKIM authentication to block spoofed domains.
Business email compromise is not a rare threat-it's a persistent, evolving risk. Recognizing its mechanics, distinguishing it from related attacks, and applying proactive safeguards are essential for protecting organizational assets.