Last year, businesses in the US lost more than $3 billion to a scam that involves no malware, no hacking. It was nothing more than a well-timed email. A business email compromise doesn't trip antivirus software or get caught in a spam filter. To every system scanning it, the message looks completely normal. That's exactly the problem. And it's why these scams are now harder to catch than ever.
Thousands of BEC scam incidents are reported to law enforcement every year. It's the reason business email compromise attack techniques have become one of the most expensive categories of cybercrime in the United States. Unlike ransomware or data breaches, BEC scams are quiet. There's no obvious red flag. Just a well-timed email that looks exactly like the ones employees receive fifty times a day. With AI, these emails are getting harder to catch.
In a Business Email Compromise Attack, someone impersonates a trusted person to trick an employee into wiring money or handing over sensitive data. Unlike phishing efforts that fire off thousands of bland emails, BEC is more focused. The attackers do their homework on the victim and look over the companyâs organogram. Theyâll often spend weeks quietly reading email conversations before they send anything that looks off.
There's no malicious attachment to scan for. No suspicious link for a security filter to flag. The email itself is the entire attack. This is exactly why traditional email security tools that are built to catch malware and known-bad URLs let BEC scams sail straight into an inbox.
The FBI's Internet Crime Complaint Center (IC3) groups BEC into a handful of familiar plays. The fake-CEO wire request. The compromised vendor invoice swap. The payroll-diversion request from "HR. The scripts haven't changed much in a decade. What has changed is how convincingly attackers can now perform them.
If you think BEC is a niche problem, the federal government's own data says otherwise. According to IC3âs most recent Internet Crime Report, business email compromise losses hit something like $3.04 billion in one year. Theyâre back up again after a short dip, still riding that three-year storyline that hangs around the $3 billion mark. The average loss per complaint is now over $122,000. The big chunk of stolen funds moves through wire transfers or ACH payments. So, itâs not just âoh it landed in an inbox,â itâs that the fraud lands right inside actual money workflows.
If you zoom out a bit, the whole thing gets even louder. When you combine business email compromise with phishing and government impersonation schemes, email-based fraud makes up roughly one-fifth of all cybercrime losses the FBI reports in a given year. Thatâs billions of dollars that leave legitimate businesses. Because somewhere, someone saw a message that looked normal and clicked âapproveâ on a payment.
For mid-sized businesses, this imbalance is especially sharp. They often lean on a single or two-person finance setup. In such cases, one convincing email in the right tone is all that it takes.
The core mechanics of a BEC scam haven't changed. What's changed is the execution and it's worth walking through exactly how.
For years, security awareness training leaned heavily on "spot the typo." Poor grammar and generic greetings ("Dear Valued Customer") were the giveaways. That advice is aging badly. Attackers including non-native English speakers can now run their draft messages through large language models and produce a copy that's grammatically flawless and tonally on-brand for the executive they're impersonating.
Security researchers have already documented a sharp rise in AI-related fraud complaints, with the FBI noting tens of thousands of AI-linked reports and hundreds of millions of dollars in associated losses in its most recent annual data. The tools that make marketing copy sound more human are making fraudulent wire requests sound more human too.
Instead of breaking into a real executiveâs inbox, a lot of attackers simply register a domain thatâs almost the same as the real one. Like swapping an âmâ for ârnâ, tossing in a hyphen, or picking a totally different top-level domain, stuff like that. At a glance, especially in a busy inbox on a phone screen, the difference is pretty much invisible. Then add a spoofed display name that lines up with the real CEOs, and most folks just wonât notice, unless theyâre specifically looking at the actual email address.
This is one of the more unsettling escalations. Rather than firing off a cold email, attackers whoâve already snuck into one mailbox through a previous smaller compromise will wedge themselves into a legit email thread. Since the conversation has real history, real signatures, and real context, the fraudulent request that shows up later inside it looks completely authentic. And honestly, there is no real reason to be suspicious of a thread youâve been in for weeks, right?
Voice-cloning tools now need only a few seconds of audio pulled from an earnings call or a company podcast to generate a convincing impersonation. There have already been widely reported cases of finance employees receiving what sounded like a live phone call or video message from their CFO, authorizing an urgent transfer, when no such call ever happened. As these tools become cheaper and more accessible, voice and video verification are becoming just as exploitable as email.
Modern BEC attackers don't rush. They'll spend weeks studying a company's LinkedIn posts and out-of-office replies to learn exactly when an executive will be traveling or unreachable. This is the ideal window for a fraudulent request, since there's no easy way to quickly verify it in person. Vendor invoices are especially popular targets: attackers monitor real invoicing cycles, then send an "updated banking details" email timed to intercept the next legitimate payment.
That classic one-email trick is now getting pushed aside by campaigns that kinda mash together a spoofed email with a follow-up text message, or even a spoofed phone call, all of it basically saying the same misleading urgency. If an employee goes to âconfirm itâ the obvious way, theyâre often just validating the fraud instead of catching it. Because the attacker steers every single route involved.
Given how sophisticated these attacks have become, employees need sharper instincts. Here's what actually holds up:
Urgency is the tell, not the grammar. Nearly every BEC scam relies on time pressure. Genuine financial requests can almost always tolerate a five-minute verification call. Scams can't.
Check the email address. Tap or hover on the sender's name. A single altered character in the domain is often the only clue.
Be suspicious of any request to change payment details. A vendor suddenly asking for a new bank account, or an executive requesting a switch to a personal email address "for this one," is one of the most consistent BEC patterns on record.
Verify sensitive requests every time. If a request involves money or sensitive data, confirm it through a different channel.
Watch for oddly specific knowledge paired with oddly wrong details. Attackers who've done their homework will get names, titles, and recent events right. But they often stumble on internal-only details, like an approval process or a person's actual reporting line, that a real colleague would know instinctively.
Notice when a reply doesn't match the thread. If a long-running email conversation suddenly comes to a financial request, take a pause. Even if everything else about the thread looks legitimate.
Spotting individual scams matters. But relying on employee vigilance alone is a losing strategy against well-crafted attacks. Real protection requires BEC prevention best practices built into company processes and technology, not just training slides.
Enforce dual approval on payments. No wire transfer or vendor payment change should be executed by a single person acting alone, regardless of who appears to have requested it. This single control eliminates the majority of successful BEC payouts.
Set up call-back verification as a hard rule. Any request to move money or change banking details gets confirmed by phone, using a number pulled from an existing internal record. Not the one included in the email itself.
Deploy email authentication protocols. SPF, DKIM, and DMARC are the technical standards that verify a sending domain is legitimate. But these standards remain badly underused. Industry research has found that a large share of US organizations still hasnât reached full DMARC enforcement, leaving a wide-open lane for domain spoofing that these free, well-established protocols are specifically designed to close.
Use AI-aware email security tools. Traditional filters look for known-bad attachments and links. Newer email security platforms analyze writing style and relationship history to flag messages that deviate from an executive's normal patterns. Thus, catching the well-written and link-free emails that older tools miss entirely.
Limit publicly available executive details. Travel schedules and even auto-reply messages hand attackers a ready-made script. Tightening what's shared externally closes off easy reconnaissance.
Run realistic and recurring training. Not annual box-checking. Simulated BEC attempts keep the pattern recognition sharp. The goal is to make every employee aware and cautious.
Establish a rapid-response plan. If a fraudulent transfer does go out, speed matters enormously. Contacting the bank and filing a complaint with IC3 within the first 24 hours dramatically improves the odds of a recovery through the FBI's Recovery Asset Team, which has clawed back hundreds of millions of dollars in stolen funds by acting fast on early reports.
Small businesses often assume they're too small to be worth an attacker's time. The data says the opposite. Smaller companies are frequently targeted because they lack layered defenses. Good email security for small businesses doesn't require an enterprise security budget. It starts with the basics, in this order:
Turn on multi-factor authentication for every email account, without exception.
Configure SPF, DKIM, and DMARC on your company domain. Most are available at no cost through your existing email provider.
Put a two-person rule in place for any payment above a set threshold.
Pick one email security add-on that specifically flags look-alike domains and unusual sending behavior.
Write down exactly how employees should verify a financial request. Make sure everyone who touches money has read it.
They're related but not identical. Phishing is a wider attack that includes malicious links or attachments. BEC is narrow and personal. A carefully researched message aimed at one person. Many BEC campaigns start with a successful phishing attempt. However, no malware is involved.
Some policies do, but coverage varies widely, and many carriers now require proof that basic controls like dual approval on payments or documented verification procedures were in place at the time of loss. It's worth reviewing a policy's specific BEC and "social engineering fraud" language rather than assuming standard cyber coverage applies automatically.
Contact the bank immediately and request a wire recall. Then file a complaint with the FBI's IC3 as soon as possible. Speed in the first 24 to 72 hours matters more than anything else. The Recovery Asset Team's success rate drops sharply the longer a business wait.
Yes. Larger companies have layered financial controls and dedicated security teams. Smaller businesses often have a single person approving payments. This makes a convincing email far more likely to succeed uncontested.
With business email compromise losses US companies report climbing back toward $3 billion a year, and AI tools making every fraudulent email a little more convincing than the last, the old advice to "just look for red flags" isn't enough anymore. What actually works is a process. Verification steps that don't depend on trusting an email at face value, technology that catches what employees can't, and a culture were pausing to double-check a payment request is standard practice, not an insult to the person who sent it. The attackers have gotten more patient and more polished. The businesses that stay ahead of them are the ones that stopped assuming a well-written email is a safe one.
