Business email compromise (BEC) is a scam in which criminals hack or impersonate a business email account to trick employees, customers or vendors into sending money or sensitive information.
Business email compromise (BEC) is a scam where criminals take over or imitate a business email account, then use it to request payments, change bank details, or ask for sensitive information. The emails look routine, which is why they work. Verifying payment changes by phone and turning on multifactor authentication stop most attempts.
A supplier emails to say their bank details have changed. Your office manager updates the payment and thinks nothing of it. Weeks later, the real supplier asks why they haven't been paid. That's business email compromise, and it often looks like an ordinary Tuesday.
How does business email compromise work?
BEC usually takes one of three forms:
- Spoofed email: the scammer sends a message that claims to be from your domain or a partner's domain. Domains without a DMARC policy are easiest to fake.
- Lookalike domain: the scammer registers a near-copy, like yourbusness.com, and hopes nobody notices the missing letter.
- Hijacked inbox: the scammer steals a real email password, often through phishing, then reads the conversations and sends requests from the real account.
The request itself is usually simple: pay this invoice, update these bank details, send over the employee records.
Why does BEC matter for small businesses?
BEC needs no special tools, just a believable email and someone who's busy. Small teams often have one person handling payments, with few checks between a request and a transfer.
The FBI notes that BEC targets everyone from small local businesses to large corporations. The fixes below are inexpensive and mostly about habits.
How do I protect my business from BEC?
- Confirm any new or changed payment details by calling a number you already have, never one in the email. The FBI recommends using a secondary channel to verify these requests.
- Turn on multifactor authentication for every email account, so a stolen password isn't enough.
- Check your DMARC policy with our free DMARC checker. If it's missing or set to
p=none, follow the DMARC fix guide. - Look closely at sender addresses, especially on a phone, where only the display name may show.
BEC vs phishing
Phishing casts a wide net to steal logins. BEC is targeted and goes straight for the payment or the data. The two are often linked: a phishing email steals the password, and BEC is what the criminal does with it. Our guide to stopping email spoofing covers both.
A free CyberVigil scan checks your SPF, DKIM and DMARC settings alongside your website.
Common questions
What should I do if we sent money to a scammer?
Call your bank immediately and ask them to recall the transfer. The FBI says time is of the essence. Then file a complaint at ic3.gov, which may help banks and law enforcement freeze the funds.
Does DMARC stop business email compromise?
It helps with one version. DMARC makes it much harder to send email using your exact domain. It can't stop lookalike domains or emails sent from a hacked inbox, so you still need payment verification and multifactor authentication.
How is BEC different from phishing?
Phishing usually tries to steal a password or install malware. BEC goes straight for the money or data, often with no link or attachment at all, just a believable request from someone you trust.
Sources
- Business Email Compromise: The $55 Billion Scam (PSA I-091124-PSA) (FBI Internet Crime Complaint Center (IC3))
- Set up DMARC to validate email in Microsoft 365 (Microsoft Learn)
Related guides and tools
Keep building a safer business
Security is an ongoing process, but it doesn't have to be complicated. Run a free scan, fix what matters most, and check back for more guides.