Business Email Compromise (BEC).

What is business email compromise?

Business email compromise, or BEC, is a scam aimed at businesses and individuals who make legitimate requests to move money. The FBI Internet Crime Complaint Center (IC3) describes it as a sophisticated scam. It says the people behind it typically compromise email accounts through social engineering or computer intrusion to carry out unauthorized transfers of funds.

Social engineering means tricking a person into doing something, such as sharing a password or approving a payment. A computer intrusion means breaking into a system or account.

How does a BEC scam work?

The IC3 describes the aim as redirecting a money transfer. One form it names is payroll diversion. In that scheme, scammers send spoofed emails that appear to come from employees and ask to change direct deposit details. A spoofed email is one that looks as if it came from someone else.

What does a simple BEC example look like?

This is a simple illustration only. A payroll team gets an email that appears to come from an employee. It asks to change where the salary is paid. If the team acts on it without checking, the money can go to the wrong account.

How big is the problem?

The IC3 reports that between October 2013 and December 2023, BEC scams resulted in over 305,000 incidents globally and approximately $55.5 billion in exposed losses. These are the IC3’s figures for that period.

How can you spot and reduce BEC risk?

The FBI IC3 gives these steps.

• Use secondary channels or two-factor authentication to verify requests to change account information.
• Verify sender email addresses carefully, including on mobile devices.
• Do not supply login credentials or personal identifiable information by email.
• Use a different password for each online account.
• Monitor financial accounts regularly for suspicious activity.

What should you do if you are a victim?

The IC3 says to act quickly. Contact your bank to request recovery of the funds, and file a report at ic3.gov. The IC3 says the FBI may be able to help freeze fraudulent transfers at financial institutions.

Is BEC the same as phishing?

No. Phishing is a method of tricking people with fake messages. BEC is the wider scam that aims at an unauthorized transfer of money. A fake message can be one way a BEC scam is carried out.

Does BEC always involve a hacked email account?

The IC3 says the people behind BEC typically compromise email accounts, using either social engineering or computer intrusion. The details can differ from case to case.

Who can be targeted?

The IC3 says BEC targets both businesses and individuals who perform legitimate transfer-of-funds requests.

A forged sender is one way to make such a message look genuine; see email spoofing.