Phishing is the broad tactic of impersonating a trusted source to make someone click, open, reply, disclose information or surrender credentials. Business email compromise (BEC) is a payment-focused fraud pattern that targets people who handle legitimate transfers, using a spoofed or hijacked account to redirect money or approve a fraudulent purchase. An advance-fee scam demands money first for a promised prize, grant, inheritance, job, loan or other benefit that never arrives or is worth far less.
The labels can overlap. A criminal may use spearphishing to steal an employee’s password, then use the mailbox to launch BEC. A phishing message can also deliver an advance-fee demand. Classify the incident by the immediate objective and the action requested: information or access, an unauthorized business payment, or an upfront fee for a promised return.
As an Amazon Associate I earn from qualifying purchases.
The three scams at a glance
| Question | Phishing | Business email compromise (BEC) | Advance-fee fraud |
|---|---|---|---|
| Primary objective | Steal credentials, personal information or access; sometimes deliver malware. | Redirect or induce an unauthorized business or personal transfer. | Collect money before delivering a promised benefit. |
| Account status | The sender or website may be entirely spoofed. | The attacker may spoof an address or use a genuinely compromised mailbox. | Identities are commonly invented or impersonated; no account takeover is required. |
| Typical request | Click a link, open an attachment, reply, or enter a password, card number or banking PIN. | Change supplier bank details, pay an invoice, buy gift cards, wire funds or make another transfer. | Pay a tax, deposit, processing charge, release fee or other amount before receiving value. |
| Main harm | Credential theft, malware infection or data exposure. | Direct financial loss and compromise of payment or business processes. | Upfront loss, often followed by identity theft or additional payment demands. |
These are behavior-based categories, not mutually exclusive technical labels. A single campaign can move from one category to another as the attacker’s goal changes.
What phishing means
The FBI describes phishing as a message that appears to come from a legitimate business and asks the recipient to update or verify personal information, often through a look-alike website. The site captures passwords, card numbers or banking PINs. The same family includes vishing (voice calls), smishing (text messages) and pharming (redirecting a user to a fraudulent site even after the user enters a legitimate address).
#1 Best Overall
Spoofing is the disguise that makes the approach credible. The FBI defines it as changing an email address, sender name, phone number or website URL—sometimes by only one letter, symbol or number—to make the target believe the contact is trusted. A message can therefore be phishing even when no account was hacked: the visible sender and the real sender are different.
What the attacker wants
- A login password or one-time authentication code.
- Payment-card, banking or tax information.
- Personal details that can support identity theft.
- A file opening that installs malware or enables later intrusion.
- A reply that confirms the address is active and starts a longer social-engineering exchange.
Recognition example
An email says your bank password has expired and provides a “verify now” link. The destination imitates the bank’s sign-in page and records what you type. That is phishing regardless of whether the sender’s mailbox was compromised.
What business email compromise means
The FBI’s Internet Crime Complaint Center (IC3) defines BEC, also called email account compromise (EAC), as a sophisticated scam targeting businesses and individuals who perform legitimate transfer-of-funds requests. Attackers commonly compromise a business or personal email account through social engineering or computer intrusion and then conduct unauthorized transfers. They can also achieve the same result by spoofing an address without taking over the mailbox.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteCommon BEC scenarios
- Supplier or invoice diversion: A familiar vendor supposedly sends revised bank details for an invoice already expected by accounts payable.
- Executive impersonation: A message appearing to come from a director requests an urgent wire, gift cards or another purchase, often with instructions not to call.
- Real-estate or closing fraud: An attacker inserts new account information into a legitimate transaction thread.
- Payroll diversion: An employee’s direct-deposit details are changed after a convincing request.
- Attorney, client or partner impersonation: The attacker uses a trusted relationship and a plausible deadline to bypass normal approval.
Why BEC can look legitimate
A compromised mailbox contains real names, signatures, schedules, invoice numbers and conversation history. The attacker can answer follow-up questions in the same thread and send from the genuine account. A spoofed message can be almost as convincing because it copies branding and display names. A bank-account-change request is BEC even when investigators later find that the supplier’s mailbox was never hacked.
Scale of the loss
IC3 statistics covering October 2013 through December 2023 recorded 305,033 domestic and international BEC incidents and $55,499,915,582 in exposed losses. IC3’s 2024 public service announcement reported a 9% increase in identified global exposed BEC losses from December 2022 to December 2023. “If you discover a fraudulent transfer, time is of the essence,” IC3 advises, because a rapid bank recall gives the best chance of stopping or recovering funds.
What an advance-fee scam means
The FBI IC3 2025 Annual Report defines advanced-fee fraud this way: “An individual pays money to someone in anticipation of receiving something of greater value in return but instead receives significantly less than expected or nothing.” The defining feature is the sequence: payment comes first, promised value later. The promise may involve a grant, inheritance, prize, job, loan, investment, immigration benefit, contract or release of supposedly trapped funds.
Typical payment demands
- A “tax” or customs charge before a prize or inheritance can be released.
- A processing, application or legal fee before a loan or grant is approved.
- A deposit to secure a job, rental, shipment or investment opportunity.
- Gift cards, cryptocurrency, cash or a wire transfer described as a refundable charge.
Once someone pays, the criminal may invent a second obstacle and demand another fee. The original promise remains out of reach, and the victim may also have disclosed identity documents or account details.
Free tools Windows power users keep installed
One-click scans. No signup required.
Recognition example
A message promises a government grant but says you must pay a “processing tax” first. That is advance-fee fraud. If the message also sends you to a fake sign-in page to collect your password, the delivery is phishing as well; the financial objective remains an advance fee.
Is BEC just phishing?
No. Phishing describes the delivery and social-engineering tactic; BEC describes a fraud objective and business process. Spearphishing is often the entry point: an employee enters credentials on a look-alike page, the attacker accesses the mailbox, and a later message requests a wire or bank-detail change. At that later stage, the incident is BEC because the immediate objective is an unauthorized transfer.
The reverse is also possible. A BEC actor may never steal credentials and may rely entirely on a spoofed sender. Calling every BEC message “phishing” hides the payment-control failure that needs urgent action. Conversely, a credential-stealing message that asks for no payment is phishing, not BEC.
How to classify a suspicious message
Use the requested action rather than the logo, tone or apparent sender. Ask these questions in order:
Recommended Free Tools
- Is the immediate request for information or access? A link, attachment, password, authentication code or personal-data form indicates phishing.
- Is the immediate request to move or approve money in a legitimate business workflow? A wire, invoice, bank-detail change, payroll change, gift-card purchase or urgent transfer indicates BEC.
- Must you pay before receiving a promised benefit? A tax, deposit, release or processing charge indicates advance-fee fraud.
- Did one step enable another? Record both labels when credential theft enabled a later payment fraud or when phishing delivered the advance-fee demand.
Signals that should stop the transaction
- Urgency, secrecy or a request to bypass a normal approval path.
- A new bank account, payment method or recipient that has not been independently confirmed.
- Instructions to buy gift cards, use a Bitcoin ATM or move money to “fix” a problem. The FTC says, “Don’t believe anyone who says you need to buy gift cards, use a Bitcoin ATM, or move money to fix a problem.”
- A sender address or domain that differs by a character from the known one.
- A request to enter credentials after following a message link instead of navigating through a saved bookmark or known address.
- A fee demanded before a prize, grant, job, loan or inheritance is delivered.
Official figures that put impersonation in context
The Federal Trade Commission’s 2024 Data Spotlight recorded more than 330,000 business-impersonation reports and nearly 160,000 government-impersonation reports in 2023, with more than $1.1 billion in reported impersonation-scam losses. The FTC’s 2025 consumer alert said email was the top method scammers used to contact people in 2024. Those figures cover impersonation broadly, so they should not be read as BEC-only totals; they show why a familiar name or logo is not proof of authenticity.
What to do when you receive one
- Stop. Do not click, reply, open attachments, enter credentials or send money.
- Verify independently. Use a phone number from a contract, statement or official website you already trust. Start a new message or call a second known contact; do not use the details in the suspicious message.
- Apply a second-person check to money. For a payment, bank-detail change or payroll update, require an independent confirmation and follow the organization’s established approval process.
- Secure potentially exposed accounts. Change the password from a clean device, make it unique, sign out other sessions and enable multifactor authentication. If an authentication code was disclosed, contact the provider immediately.
- Preserve evidence. Keep the original message, full headers, attachments, URLs, payment instructions, receipts and a timeline. Do not forward a malicious attachment around the organization.
- Report the incident. Report online fraud to the FBI’s IC3 and consumer fraud to the FTC as appropriate. Businesses should also notify their security, legal and finance teams.
If money has already moved
- Call the sending financial institution’s fraud department immediately and request a recall or reversal. Provide the recipient account, amount, date, transaction reference and copies of the communications.
- Ask the receiving institution to place a hold where possible; your bank can coordinate using established fraud channels.
- Report to IC3 and the FTC, preserving the same transaction evidence. Do not wait for a complete internal investigation before making the first bank call.
- For gift cards, contact the issuer immediately with the card numbers and receipt; for cryptocurrency, preserve wallet addresses and transaction IDs even though recovery is uncertain.
- Reset compromised credentials and review mailbox forwarding rules, delegated access, login history and payment permissions for additional changes.
Controls that reduce risk
For individuals
- Use a password manager and a different password for every important account.
- Enable multifactor authentication, preferably a phishing-resistant method where available.
- Reach a service through a saved bookmark or a manually typed address rather than a message link.
- Inspect the complete sender address and domain, not only the display name.
- Assume an unexpected fee, gift-card request or urgent money-moving instruction is fraudulent until independently verified.
For businesses
- Require out-of-band confirmation for new recipients, bank-account changes, payroll changes and urgent transfers.
- Separate the person who creates a payment from the person who approves it; set transaction limits and dual authorization.
- Train staff to report suspicious messages without blame, so a possible compromise is raised quickly.
- Enable multifactor authentication for email, finance and administrator accounts, and review sign-in alerts.
- Use email-authentication controls such as SPF and DKIM, while recognizing that authentication alone does not prove a request is legitimate.
- Monitor mailbox forwarding rules, OAuth grants, delegated access and unusual login locations.
- Maintain a written recall-and-reporting playbook with bank contacts, escalation owners and evidence-preservation steps.
Common mistakes and the better alternative
| Mistake | Why it fails | Better practice |
|---|---|---|
| Trusting a familiar display name | Display names and domains can be spoofed or copied. | Check the complete address and verify through a separate channel. |
| Replying in the existing email thread | A compromised mailbox can control the entire thread. | Start a new call or message using independently sourced contact details. |
| Making a small “test” payment | It confirms the process and can lead to larger demands. | Pause the transaction and use the formal approval path. |
| Waiting to report a transfer | Funds can move through multiple accounts quickly. | Call the bank immediately, then document and report. |
| Deleting the message | Headers and payment details may be needed for recovery or investigation. | Preserve the original securely and restrict further forwarding. |
The practical bottom line
Classify by what the attacker wants you to do now. A request to click, sign in or disclose data is phishing. A request to alter or authorize a legitimate-looking business payment is BEC, whether the sender is spoofed or the mailbox is genuinely compromised. A request for money before a promised benefit is delivered is advance-fee fraud. When more than one step appears, record the chain but respond to the most urgent harm first: stop the transfer, contact the bank, secure accounts and preserve evidence.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
