The Business Email Compromise Scam: What It Is and Why It Matters
A business email compromise scam is a type of fraud where a criminal impersonates a trusted contact — like your boss, a vendor, or a lawyer — to trick you into sending money or handing over sensitive information.
Quick answer:
- What it is: A scammer poses as someone you trust using a fake or hacked email
- How it works: They research your company, spoof an email address, then send an urgent request
- What they want: Wire transfers, payroll changes, gift cards, or private data
- Who gets targeted: Finance teams, HR staff, executives, and new employees
- How to protect yourself: Verify any unusual request by phone before acting on it
BEC is not your typical spam. It's targeted, researched, and convincing.
The FBI received 21,489 BEC complaints in 2023 alone, with losses topping $2.9 billion in that single year. Since 2013, total global exposed losses have surpassed $55 billion across more than 300,000 incidents.
One real example captures just how effective these scams can be: an accountant received an email from her CEO — who was traveling — asking for an urgent wire transfer for a confidential acquisition. The email looked legitimate. She sent over $737,000 before realizing the CEO never sent it.
The scam worked because it exploited trust, urgency, and a lack of verification — not technical hacking.
And with email being the starting point for 91% of all cyberattacks, this threat isn't going away.
How a Business Email Compromise Scam Works
To understand a business email compromise scam, we have to stop thinking of hackers as hooded figures typing code in a dark room. In BEC, scammers are more like high-stakes con artists. They don't just "blast" emails; they curate them.
The process usually begins with target research. Scammers scour LinkedIn, company websites, and social media to find out who handles the money, who the executives are, and which vendors the company uses. They might even find out that a CEO is currently on vacation or attending a specific conference, providing the perfect "cover story" for an urgent, remote request.
Next comes the technical trickery. This involves email header spoofing or creating domain variations. A scammer might register a domain that looks nearly identical to yours—for example, using company-inc.com instead of companyinc.com. This is known as typosquatting. They might also use homograph attacks, where they replace a Latin "a" with a Cyrillic "а" that looks identical to the naked eye.
Once the stage is set, they use social engineering and urgency tactics. They create a crisis that only you can solve, and it usually needs to be done "right now" and "discreetly." Get the details on how scammers operate to see how they pivot from research to a multi-thousand dollar payout.
Email Spoofing vs. Account Takeover
It is important to distinguish between "faking" an email and "owning" one.
| Feature | Email Spoofing | Account Takeover (EAC) |
|---|---|---|
| Mechanism | Forging the "From" address to look legitimate. | Gaining actual login access to a real mailbox. |
| Authenticity | High, but headers may reveal the fraud. | 100% authentic; the email is sent from the real server. |
| Difficulty | Relatively easy to execute. | Requires phishing or password cracking. |
| Detection | Can be caught by SPF/DMARC records. | Harder to detect as it's a "legal" login. |
Common Techniques in a Business Email Compromise Scam
Scammers have a toolbox full of tricks to make their emails look real. One of the most common is display name deception. On mobile devices, many email apps only show the sender's name (e.g., "CEO John Smith") rather than the full email address. If the name matches your boss, you might not click to see that the underlying email is actually scammer123@gmail.com.
Another dangerous method involves compromised credentials. Attackers use "password spraying"—trying common passwords across thousands of accounts—to get into a real employee's inbox. Read about preventing password spray attacks to understand how they bypass simple login protections. Once inside, they don't always strike immediately. They might set up "inbox rules" to forward all your sent and received mail to their own account, allowing them to sit back and watch your business conversations until the perfect moment to strike.
For a deeper dive into the mechanics of these attacks, check out our guide on understanding-business-email-compromise.
Vulnerabilities Exploited by a Business Email Compromise Scam
Why does the business email compromise scam work so well? It targets the "human operating system."
- Human Error: We are busy. When an urgent email from a manager hits our inbox at 4:30 PM on a Friday, our instinct is to help, not to scrutinize the "Reply-To" address.
- Remote Work: In a traditional office, you might walk down the hall to ask, "Hey, did you really want me to change the vendor's bank info?" In a remote world, we rely entirely on digital communication, making it easier for scammers to insert themselves into the chain.
- Lack of MFA: If an organization doesn't require Multi-Factor Authentication, a single leaked password is all a scammer needs to take over an account and start sending "official" invoices.
- Internal Trust: Companies often have high levels of trust between departments. If HR receives a request from an "employee" to change their direct deposit, they often process it as a routine task.
- Supply Chain Weaknesses: You might have great security, but does your third-party vendor? Scammers often compromise a smaller supplier to send fake invoices to their larger, wealthier clients.
Read more about what CISOs should know regarding the current state of security awareness and how to build a culture that resists these social engineering attempts.
The Most Damaging Types of BEC Attacks
Not every business email compromise scam looks the same. Depending on the goal, the scammer will choose a specific "persona" or scheme.
- CEO Fraud: The scammer impersonates a high-level executive (CEO, CFO, or COO). They send an email to an employee in the finance department, requesting an urgent wire transfer for a "confidential" or "time-sensitive" matter.
- Fake Invoice Schemes: The attacker poses as a known supplier. They might even use a real, intercepted invoice but alter the banking details to point to their own account. This is particularly effective because the business was already expecting to pay that bill.
- Attorney Impersonation: Scammers pretend to be a lawyer or a representative from a law firm. Because people are often intimidated by legal matters or assume they are "top secret," they are less likely to question a request for a large transfer.
- Data Theft: This isn't always about money. In this scenario, HR or payroll employees are targeted to provide W-2 forms or other Personally Identifiable Information (PII). This data is then sold on the dark web or used for tax fraud.
- Gift Card Scams: A simpler but highly effective version of BEC involves an executive asking an assistant to "run out and buy $2,000 in gift cards" for a client event, then asking for the codes to be emailed over. Once the codes are sent, the money is gone instantly. Discover gift card scam tactics to see how these low-tech requests bypass high-tech filters.
To stay safe, you should learn about common types of compromised email so you can recognize the specific script the scammer is using.
Identifying Red Flags in Your Inbox
How do you spot a business email compromise scam before it's too late? Look for these "tells":
- Mismatched Domains: Always hover your mouse over the "From" name to see the actual email address. Is it
@company.comor@company-support.com? - Unusual Urgency: Phrases like "Immediate action required," "I'm in a meeting and can't talk," or "Must be completed by EOD" are designed to make you panic and skip verification steps.
- Payment Instruction Changes: Any request to change a bank account, routing number, or payment method should be treated as a 10/10 security event.
- Poor Grammar or Odd Phrasing: While some scammers are very professional, many use templates that contain subtle grammatical errors or "off" greetings that don't match your boss's usual style.
- Requests for Secrecy: If the email insists that you "keep this between us" or not follow standard procedures, it’s a massive red flag.
Global Impact and Alarming Statistics
The numbers behind the business email compromise scam are truly staggering. It is widely considered one of the most financially damaging cybercrimes because it targets the actual movement of money rather than just stealing data to sell later.
According to the FBI's Internet Crime Complaint Center (IC3), the growth of BEC has been explosive. Between 2013 and 2023, the global "exposed dollar loss"—which includes both actual losses and attempted thefts—reached over $55 billion.
- 2023 FBI Data: Over 21,000 complaints resulting in $2.9 billion in losses.
- The 91% Rule: Email is the entry point for 91% of all cyberattacks.
- Canadian Impact: In 2020, the Canadian Anti-Fraud Centre (CAFC) reported nearly $30 million in BEC losses. By the first half of 2021, that number had already hit $26 million.
- Growth Trend: There was a 9% increase in identified global exposed losses from BEC scams between late 2022 and late 2023.
For more historical context on how we reached these numbers, you can review the Internet Crime Report 2021.
How to Prevent and Respond to BEC Attacks
At Tempo Mail USA, we believe that the best defense is a proactive one. Protecting your organization from a business email compromise scam requires a mix of technical settings and human training.
1. Multi-Factor Authentication (MFA): This is the single most important step. Even if a scammer steals an employee’s password through phishing, they won't be able to log in without the second factor (like a code from an app). How MFA prevents phishing is a must-read for any business owner.
2. Out-of-Band Verification: Establish a policy that any change to payment instructions or large wire transfers must be verified through a second channel. If you get an email, pick up the phone and call a known number (not the one in the email) to confirm.
3. Authenticate Your Senders: Use technical protocols like SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC. These tools act like a digital passport for your emails, making it much harder for scammers to spoof your domain. Learn about authenticating senders with SPF and DMARC to lock down your outgoing mail.
4. Employee Training: Your team is your perimeter. Regular training sessions and even "mock" phishing tests can help employees stay sharp. Read these six tips to make email safer for actionable advice you can share with your staff today.
Immediate Steps After a Security Breach
If you realize you’ve been hit by a business email compromise scam, every second counts.
- Contact Your Bank Immediately: Call your financial institution and ask them to perform a "fund recall." If the money was sent recently, there is a small window where the bank can freeze the transfer before it hits the scammer’s account.
- Report to Authorities:
- In the US: File a complaint with the FBI IC3.
- In Canada: Report to the Canadian Anti-Fraud Centre and your local police.
- Reset Credentials: Change passwords for all affected accounts and ensure MFA is enabled.
- Check for Persistence: Scammers often leave "backdoors." Check your email settings for any unauthorized forwarding rules or new "trusted devices."
- IT Incident Response: Engage your IT team to scan for malware. Sometimes a BEC scam is just the first step in a larger ransomware attack.
Frequently Asked Questions about BEC
What is the difference between BEC and standard phishing?
While all BEC is phishing, not all phishing is BEC. Standard phishing is usually a "spray and pray" tactic—sending millions of generic emails (like fake Netflix login alerts) to see who bites.
A business email compromise scam, on the other hand, is "spear-phishing." It is highly targeted. The scammer knows your name, your boss's name, and your company's vendors. The goal is almost always a high-value financial transfer or the theft of corporate data, rather than just stealing a single person's credit card number.
Why is BEC so difficult for traditional security software to detect?
Most antivirus and spam filters look for "malicious payloads"—things like suspicious links or infected attachments. However, many BEC emails contain neither.
They are plain-text emails that look like a normal business conversation. Because the scammer is using "linguistic manipulation" and social engineering, there is no "virus" for the software to catch. This is why human vigilance is so critical.
Who are the primary targets of BEC within a company?
Scammers go where the money and data live.
- Finance Departments: The obvious target for wire transfer and invoice fraud.
- HR Managers: Targeted for employee PII and W-2 forms.
- C-Suite Executives: Their accounts are compromised to gain authority and send "orders" to subordinates.
- New Employees: Scammers target new hires because they are eager to please and may not yet be familiar with the company's official payment procedures.
Conclusion
The business email compromise scam is a sophisticated, evolving threat that costs businesses billions of dollars every year. It doesn't rely on complex code; it relies on us being too busy or too trusting to double-check a sender's identity.
By building a culture of security, implementing Multi-Factor Authentication, and always verifying financial requests through a second channel, you can protect your organization from becoming another statistic.
At Tempo Mail USA, we are committed to providing the tools and knowledge you need to keep your digital identity secure. Whether you're using temporary email aliases to shield your PII or implementing robust corporate security protocols, staying informed is your best defense.
Stay vigilant, stay skeptical, and always verify before you click.