Business Email Compromise: How It Works and How to Stop It

Not every costly cyberattack involves malware. One of the most expensive is just a convincing email, sent at exactly the right moment, asking someone to move money. It’s called business email compromise, or BEC, and it hits businesses of every size.

This post explains how the scam works, the forms it takes, and the specific controls that stop most of it.

How the scam actually unfolds

Most cases follow the same pattern:

1. They get into an email account. It might be yours, a vendor’s, or a client’s. The usual routes are a stolen or reused password or a fake Microsoft 365 login page. Accounts without multi-factor authentication (MFA) are the easiest to take over.
2. They watch. For days or weeks, the attacker reads real conversations and learns who pays whom, how invoices look, and when payments are due. They often create inbox rules that hide replies from the real account owner.
3. They step in at the right moment. A message arrives in an existing email thread with “updated” payment details, or an urgent request that appears to come from a boss. It may come from a hacked account or from a lookalike domain that differs by one letter.
4. The money moves, then moves again. Funds are often forwarded onward within hours, which is why speed matters so much afterward.

Nothing about this attack looks like a hack. It looks like normal business email, which is exactly why it works.

Common versions of the scam

• The changed bank details. A vendor “tells” you their bank account has changed and asks you to send this month’s payment to the new one.
• The executive request. A message that looks like it’s from the owner or a manager asks someone in accounting to send a wire or buy gift cards today, because they’re in a meeting.
• The payroll switch. An email that looks like it’s from an employee asks HR to change their direct deposit to a new account.
• The closing wire. Fake “updated” wire instructions arrive just before a real estate closing, a settlement, or a client fund transfer.

Who is at risk

Any business that pays invoices, runs payroll, or moves money by wire or ACH. Firms that handle other people’s money, such as law offices, accounting firms, real estate and title companies, and property managers, are especially attractive because the amounts are large and the payment deadlines are firm. Small businesses are targeted partly because they have fewer checks in place: often one person can approve and send a payment alone.

How big is the problem?

The FBI’s Internet Crime Complaint Center reported that business email compromise caused about $3 billion in losses in 2025, second only to investment fraud among the crime types it tracks. Those are only the losses that were reported, and many incidents never are. You can read the full report at ic3.gov.

Seven controls that stop most of it

1. Turn on MFA for every email account. No exceptions, including owners and part-time staff. This single step blocks most account takeovers.
2. Verify any change to payment details by phone. Call a number you already had, not one from the email. Do this for every new or changed bank account, wire instruction, or direct deposit request, every time, even if the sender looks right.
3. Require two people for payments. One prepares, a second approves, above an amount you set. Make this rule apply to “urgent” requests from the boss too, because those are exactly the ones attackers fake.
4. Protect your own domain. Set up SPF, DKIM, and DMARC so criminals can’t easily send email that appears to come from you, and watch for lookalike domains.
5. Monitor mailboxes for warning signs. Hidden forwarding rules, logins from unusual places, and new devices are all early signals. This is what security log monitoring is for.
6. Make it safe to pause. Attackers rely on urgency. Staff should know that stopping to verify is always the right call, and that no one gets in trouble for it.
7. Protect the computers themselves. Password-stealing malware on a laptop can undo everything above. Modern endpoint protection catches the behavior that old antivirus misses.

If money has already gone out

Act within minutes, not days:

1. Call your bank’s wire or fraud department immediately and ask them to attempt a recall and contact the receiving bank.
2. File a report with the FBI at ic3.gov as quickly as you can.
3. Notify your cyber or crime insurance carrier and your attorney.
4. Preserve everything. Don’t delete emails, and don’t wipe any computers until a professional has looked at them.

For the full response to a serious incident, see our guide on what to do in the first 24 hours after a ransomware attack. Much of it applies here too.

Rules that may apply to your business

Depending on your industry, a fraud incident can also trigger legal obligations. Tax preparers, mortgage brokers, and real estate settlement companies are among the businesses treated as financial institutions under the FTC’s Safeguards Rule, which requires a written security program, safeguards like MFA, and reporting of certain larger breaches to the FTC within 30 days. Medical practices have HIPAA, and Louisiana has its own breach notification law. The FTC publishes a plain-language summary: FTC Safeguards Rule: What Your Business Needs to Know. Ask your attorney or compliance advisor which rules apply to you.

Where to start

If you do only three things this week, turn on MFA for every mailbox, adopt the phone-verification rule for payment changes, and require a second approver on payments over a set amount. Then take a look at where the rest of your security stands. Our free security snapshot is a good place to begin, and you can see how our monitoring and protection work on the services page.

This article is general information, not legal advice.