Business email compromise (BEC) is payment fraud that exploits a real or impersonated email identity to make a business, employee, or financial institution send money to a criminal. A message can appear to come from a legitimate account and fit an existing invoice or conversation, so a familiar name or thread is not enough to authenticate new payment instructions.
The title’s “billion-dollar threat” is best understood as a reference to BEC’s cumulative reported losses, not a single year’s losses or losses borne only by financial firms. The practical defense is to verify payment changes through a separate, previously trusted channel before money moves.
As an Amazon Associate I earn from qualifying purchases.
What business email compromise is—and why it works
BEC, also called email account compromise (EAC), exploits the trust built into routine payments. Criminals try to make an unauthorized transfer look like a normal business transaction. The request may concern a vendor invoice, a wire transfer, an executive expense, or a change to bank-account details.
Recommended Free Tools
The sender may be a criminal controlling a real email account, or an impostor using a lookalike address or website. Attackers can also use information taken from an account to write a message that fits a real billing relationship. A convincing reply in an existing thread is not proof that the account—or the payment instruction—remains trustworthy.
#1 Best Overall
The FBI describes social engineering methods used to gain access or defeat protections, including phishing, employee impersonation, SIM swapping, and call forwarding. Spearphishing can steal credentials; malware may let criminals read invoice and billing conversations. Either route can help them time a fraudulent request to coincide with legitimate business activity. FBI cybersecurity advisory, April 11, 2024; FBI business email compromise guidance.
How a BEC payment gets through
FinCEN describes a three-stage pattern: account access, fraudulent instructions, and an unauthorized transfer that appears legitimate.
- Gain access and gather context. Through social engineering or computer intrusion, criminals unlawfully access an email account and collect details about financial institutions, accounts, contacts, and ongoing transactions.
- Send a plausible instruction. They send a payment request from an account they control or a lookalike address, often using the information they found to make the message credible.
- Persuade someone to act. An employee or financial institution executes a transfer that looks routine but was not authorized by the person or organization it appears to represent.
That pattern explains why the fraud is not always an obvious, poorly written cold email. The weak point is often the assumption that a familiar sender or current conversation guarantees that a new payment detail is genuine. FinCEN, Advisory to Financial Institutions on E-mail Compromise Fraud Schemes.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Examples of requests that can be fraudulent
- A regular vendor’s invoice arrives with a changed mailing address or payment details.
- An executive asks an assistant to buy gift cards.
- A title company appears to send a homebuyer new wire instructions.
The FBI reports these scenarios among real BEC cases, with victims sending thousands or hundreds of thousands of dollars to criminals. An unexpected change to a familiar process deserves independent verification, even when the request arrives in a known thread. FBI business email compromise guidance.
Rank #3
What the reported dollar figures mean
The FBI’s Internet Crime Complaint Center (IC3) reported $55,499,915,582 in global exposed dollar loss from October 2013 through December 2023, across 305,033 domestic and international incidents. Its 2024 notice says the figures were reported to IC3 and law enforcement and were also derived from filings with financial institutions. This is a decade-plus cumulative exposed-loss figure—not a one-year total, not a count of confirmed unrecovered money, and not a figure limited to banks or other financial firms. IC3 also reported a 9% increase in identified global exposed losses from December 2022 to December 2023. IC3, 2024 BEC notice.
A separate figure should not be confused with that dollar total: a 2025 Federal Reserve Financial Services article says BEC accounted for 73% of reported cyber incidents in 2024, attributing the statistic to an external source. That percentage measures a share of reported incidents, not dollars lost, and is not presented as an original Federal Reserve measurement. Federal Reserve Financial Services, 2025 article.
These are reported-incident and exposed-loss figures, not a complete census of all BEC fraud. Reporting totals do not establish how much money was permanently lost, and the global IC3 total does not mean every incident involved a financial firm.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →How to verify a changed bank account or payment instruction
Make payment changes a high-risk transaction, not a routine email update. Before sending money to new or altered details, confirm the change using a phone number or other contact channel already on file—not details in the message requesting the change. For larger or unusual transfers, use a second authorized contact or another approval step consistent with your organization’s process.
Best Value
- Pause the payment. Do not reply with sensitive information or use links and phone numbers in the message to confirm it.
- Contact the person or organization independently. Use a previously verified number or a trusted channel already established before the request arrived.
- Confirm the exact change. Read back the account or wire details and ask whether the request is authorized. Do not treat a confirmation from the same compromised email thread as independent verification.
- Follow approval controls. Require a second authorized approver when appropriate, and document who confirmed the details and through which channel.
FinCEN warns that fraudulent wires are often difficult or impossible to cancel once executed, making verification before payment essential. FinCEN advisory.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Controls that reduce opportunities for BEC
No single control addresses every route into a payment workflow. The official guidance supports combining account protection, transaction verification, and staff readiness; it does not establish quantified risk reductions or controlled comparisons between individual measures.
Protect accounts and detect suspicious access
- Use multifactor authentication (MFA) where available, and avoid email-based MFA. The FBI advises organizations to refine MFA and monitor suspicious logins and compromised credentials.
- Inspect email addresses and URLs closely, and treat unexpected sign-in prompts or credential requests as suspicious.
- Train help-desk and customer-support staff with current phishing examples; attackers may target support processes as well as individual inboxes.
- Consider phishing-resistant MFA, such as FIDO2/WebAuthn security keys, only where it is compatible with the organization’s identity provider and policy. The FBI points readers to CISA guidance on phishing-resistant MFA; no particular key or brand is endorsed by the cited guidance.
Make payment verification independent of email
- Verify new or changed payment details through a previously known phone number or another trusted channel.
- Use multiple authorized approvers for high-risk changes where appropriate.
- Add a banner identifying messages received from outside the organization, as the FBI recommends. A banner is a warning aid, not proof that an internal message is safe: an attacker may be using a real compromised account.
These layers serve different purposes: account controls can make access harder or more visible, while independent confirmation checks whether a payment instruction is authorized. Neither makes the other unnecessary. FBI advisory; FBI BEC guidance.
What to do if money has moved or someone clicked a phishing link
If a fraudulent transfer may have been sent
- Contact the sending financial institution immediately. Explain that the transfer may be fraudulent and request a recall. Recovery is not assured, but speed matters.
- Report the incident to IC3 as soon as possible. FinCEN says recovery efforts have had greater success when law enforcement is contacted within 24 hours; that is not a guarantee or a deadline after which reporting is pointless.
- Preserve transaction and message details. Keep the amount, date and time, sender and beneficiary information, relevant email addresses, IP addresses if available, and message timing. Financial institutions should preserve transaction details and relevant cyber information.
IC3, 2024 BEC notice; FinCEN advisory.
If an employee clicked a phishing link
Notify the organization’s IT or security team promptly and follow its incident-response process. If credentials were entered, the team should treat the account as potentially exposed, assess suspicious logins, and secure access under its established procedures. If the incident is connected to a payment request, pause the transaction and verify its instructions through a trusted separate channel before acting. The FBI’s guidance emphasizes suspicious-login monitoring, compromised-credential response, MFA, and staff training. FBI advisory.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
