What Is Business Email Compromise (BEC)?
Business email compromise, or BEC, is a scam where an attacker impersonates someone you already trust, a vendor, a supplier, or an executive at your own company, by email, in order to get a payment redirected to an account they control. There’s no malware, no hacked network, no obvious red flag. Just a convincing message that arrives at exactly the wrong moment.
How it works
An attacker either spoofs a trusted email address or gains access to a real one, then sends a message that looks routine: an invoice with “updated” bank details, a request to rush a wire before a deadline, an executive asking someone to buy gift cards while they’re “stuck in a meeting.” The message uses real names, real invoice numbers, and real context, often pulled from a previous, genuine email thread.
The scam works because it targets trust and timing, not technology. It’s most effective when the usual approver is out of office and someone less familiar with normal procedure is covering, which is exactly why BEC attempts climb during vacation season. By the time anyone questions the payment, the money is already gone and largely unrecoverable.
How to stop it
One habit stops most BEC attempts cold: verify any payment or banking-detail change with a phone call to a number you already have on file, never a number listed in the email itself. Combine that with email security that flags impersonation and spoofed domains before a message reaches the inbox, and a policy that no wire or bank-detail change goes through on email alone.
Frequently Asked Questions
Is business email compromise the same thing as phishing?
They overlap but aren’t identical. Phishing is the broader category, tricking someone into clicking a link, opening an attachment, or handing over credentials. BEC is a specific, highly targeted form of it, usually with no link or attachment at all, focused entirely on getting a payment redirected through a convincing impersonation.
Why does BEC spike around vacations and holidays?
Because the normal approval chain is disrupted. The person who’d usually recognize something’s off is out, and whoever’s covering is less likely to know what looks routine versus what doesn’t. Attackers deliberately time these scams around that gap.
How much does a BEC attack typically cost a business?
It varies widely, but losses commonly run from a few thousand dollars to well into six figures for a single wire, and the money is rarely recoverable once it’s moved through the attacker’s account. That’s why prevention, not recovery, is the entire strategy.
Can email filtering alone stop BEC?
Not on its own. Many BEC emails don’t contain links, attachments, or malware for a filter to catch, they’re just well-written text. Filtering helps catch spoofed domains and known-bad senders, but the real defense is a verification habit that doesn’t depend on technology catching everything.
Protect your business from BEC
If you want to know where your business is exposed to business email compromise and other email-based fraud, read about the risks that don’t show up until it’s too late, or book a free discovery call and we’ll walk through it with you.