threats

Business Email Compromise (BEC)

Updated October 16, 2026

Business email compromise (BEC) is fraud that abuses a trusted business identity or conversation to persuade someone to send money, disclose information, or change a business process. The message may use impersonation or a genuinely compromised mailbox. It can contain no malicious attachment or link.

2 min. read

What do I need to know about Business Email Compromise (BEC)?

A familiar sender and a real email thread do not establish that a new payment request is authorized.
BEC can target payroll, gift cards, invoices, tax documents, and other valuable workflows—not only executive wire transfers.
Domain authentication helps detect certain forms of spoofing. It cannot establish the business legitimacy of a request sent from a compromised account.
A payment-control failure and a mailbox compromise may coexist. Investigate both rather than closing the case after deleting the email.

An illustrative example

A supplier conversation continues normally until one reply changes the bank details. The invoice number and amount are correct. Those details make the message convincing, but the bank change is the event that needs independent verification. Call the supplier using contact details already held in your records, not the number in the new email.

Practical checks

Pause the requested transaction and verify the change using an established independent channel.
Preserve the message, headers, payment details, and timeline; search for related messages to other employees.
If money was sent, contact the financial institution immediately and follow the appropriate fraud-reporting process. If account access is suspected, begin containment too.

Five FAQs about Business Email Compromise (BEC)

Does BEC require a hacked mailbox?

No. Attackers can impersonate someone using a display name or lookalike domain. Other cases use real compromised accounts, so checking only for spoofing leaves an important gap.

How is BEC different from ordinary phishing?

Phishing is the broader deception technique. BEC focuses on abusing business trust and processes, often to redirect payments or obtain sensitive records. The categories can overlap.

Can a BEC email pass DMARC?

Yes. A message from a compromised legitimate account or an attacker-controlled domain may authenticate correctly. DMARC does not approve the invoice, recipient bank account, or business reason for a payment.

What is the most useful check for a bank-detail change?

Confirm it through a known contact route and your established approval process. Replying to the same email or calling a newly supplied number may keep you inside the attacker’s conversation.

What if we already transferred the money?

Contact your bank immediately to request assistance, notify your incident-response and finance leads, and preserve evidence. Report through the relevant authorities, such as IC3 in the US or the Canadian Anti-Fraud Centre in Canada; recovery is not guaranteed.