Report a
business email scam.

Business Email Compromise is a sophisticated form of cybercrime that specifically targets companies and organizations that perform wire transfers or handle sensitive employee data. Unlike mass phishing campaigns that cast a wide net, BEC attacks are carefully researched and targeted. The FBI's IC3 recorded $2.95 billion in BEC losses in 2023, but the true figure is likely much higher since many businesses don't report to avoid reputational damage.

BEC works because it exploits trust and authority rather than technical vulnerabilities. A scammer gains enough information about a company's structure — often from LinkedIn, press releases, and company websites — to impersonate an executive or vendor convincingly. They then send an email to someone in finance or HR with a seemingly legitimate request: wire $50,000 to a new account for an acquisition, update the payment details for a regular vendor, or send employee W-2 forms for a "tax audit."

Common BEC attack patterns

CEO fraud impersonates the CEO or CFO to request urgent wire transfers. Vendor email compromiseintercepts real vendor communications and redirects payments by changing bank details on invoices. Account compromiseinvolves actually hacking an employee's email and sending fraudulent requests from the real account. Data theft BECrequests employee tax records or PII rather than money. Each variant exploits the same human tendency: when the boss asks for something urgently, employees comply.

If money was wired — act immediately

Time is critical with BEC. Contact your bank immediately and request a wire recall. File a complaint with the FBI IC3 — their Recovery Asset Team has a success rate of about 73% for freezing domestic wire transfers when contacted within 24–72 hours. The faster you act, the better the chance of recovery. After the immediate response, implement mandatory dual-approval for all wire transfers and verbal verification (by phone, using a known number) for any payment changes or new payment requests.