What Is Business Email Compromise?

The short answer: Business email compromise (BEC) is fraud where an attacker impersonates or takes over a trusted person's email, such as an executive, supplier or colleague, to trick someone into sending money or sensitive data. It usually involves no malware. It works through spoofed domains, lookalike domains or hijacked mailboxes, and it is stopped by DMARC enforcement, MFA and payment verification procedures.

What BEC Is, and What It Is Not

BEC is a targeted social-engineering crime. The attacker researches who approves payments, who the suppliers are and how the company writes its emails, then sends a short, plausible request. Typical goals:

• Redirect a payment by "updating" a supplier's bank details
• Request an urgent wire transfer in the name of a director
• Ask HR or payroll for employee tax data or to change a salary deposit account
• Request gift cards or a "quick favour" from a manager
• Obtain credentials that open further accounts

It differs from mass phishing in precision. There is often no link or attachment for filters to catch, only a believable sentence from a believable sender. That is why technical email filtering alone does not stop it, and why procedure matters as much as technology.

What the FBI Data Says

The FBI's Internet Crime Complaint Center (IC3) publishes the most widely cited figures on BEC in the United States. These are losses reported by victims, so they undercount the real total and reflect US complaints only.

Across 2022 to 2024, IC3 BEC losses combined to nearly $8.5 billion, according to a Nacha summary of the FBI's data. We cite these as reported by the FBI and secondary summaries of its reports; read the originals at ic3.gov for the exact breakdowns. We deliberately do not quote an "average cost per incident" figure, because such numbers vary heavily with how they are calculated and are often repeated without a source.

The takeaway is not the exact number. It is that BEC has stayed among the costliest categories of internet crime for years, and that most reported losses move through bank transfers, where recovery depends on speed.

The Four Main BEC Techniques

1. Exact-domain spoofing

The attacker forges the From address so the message appears to come from finance@yourcompany.com. This is possible when the domain does not enforce DMARC. The attacker needs no access to your systems, only to know that receivers will accept unauthenticated mail claiming your domain. Your DMARC policy is public. You can look yours up with the DMARC checker.

DMARC at p=quarantine or p=reject instructs receivers to junk or refuse mail that fails SPF and DKIM alignment for your domain. That closes this technique, provided your legitimate senders are configured first.

2. Lookalike domains

The attacker registers yourcornpany.com or your-company.co and sends from it. This is a real, separate domain with its own valid SPF and DKIM, so DMARC on your domain does nothing. Defences are different: watch for lookalike registrations, register the obvious variants of your own name, train staff to check the full address, and use mail filtering that flags first-time or lookalike senders.

3. Display-name spoofing

The From name says "Sarah Chen, CEO" while the address is a free-mail account. Many mobile mail apps show only the name. DMARC cannot help because the domain is not yours. Mail platforms can flag external senders whose display name matches an internal person, and a banner on external mail helps.

4. Account takeover and vendor email compromise

The attacker logs into a genuine mailbox using stolen or reused credentials, reads past conversations and replies inside real threads. Because the mail truly comes from the real account, SPF, DKIM and DMARC all pass. A compromised supplier's mailbox is just as dangerous: you receive a genuine message from a genuine supplier with changed bank details. Defences are MFA, alerts for new inbox rules and logins, and out-of-band verification.

Be sceptical of any vendor claiming one control stops BEC outright. Layering is the actual answer.

Warning Signs in the Message

No single sign is proof, but these patterns recur in BEC attempts:

For a suspicious message, look at the Authentication-Results header. A forged message from an unprotected domain might show:

Authentication-Results: mx.example.net;
       spf=fail smtp.mailfrom=finance@yourcompany.com;
       dkim=none;
       dmarc=fail (p=none) header.from=yourcompany.com

If your own domain's mail shows dmarc=fail and the policy is none, it was delivered anyway only because the policy asked receivers to take no action. The guide to reading email headers explains each field.

An Illustrative Spoofing Scenario

This is a hypothetical example to show the mechanics, not a reported case.

1. An attacker looks up yourcompany.com and sees a DMARC record of p=none, or none at all.
2. They find your accounts payable contact and a real supplier name on LinkedIn and your website.
3. They send a message from a forged finance@yourcompany.com asking to update a supplier's bank details before the next payment run.
4. The message passes casual inspection because it shows your own domain. If your receiving system does not warn on failed authentication, nothing alerts the recipient.
5. The next payment goes to the attacker's account. The error comes to light when the real supplier asks where their money is.

With DMARC at reject, step 3's forged message would normally be rejected by receivers that honour DMARC, so it would not reach the inbox. Note that this protects the people who receive your domain's mail. It does not protect your own staff from a lookalike domain pretending to be a supplier.

Why Small Businesses Are Attractive Targets

• Fewer layers of approval. One person may be able to release payments, so one convincing email is enough.
• Authentication left half-finished. Many domains sit at p=none for years after a first setup.
• Less formal training. Staff are less likely to have seen a BEC example or a verification script.
• Public information. Company websites, LinkedIn and invoices reveal who pays whom.
• Valuable relationships. A small supplier that bills a larger company is a route into that company too.

Technical Controls That Reduce BEC Risk

1. SPF, DKIM and DMARC with enforcement. Start with SPF, DKIM and DMARC explained, then follow the DMARC policy guide to move from p=none to reject safely. Platform steps: Google Workspace DMARC and Microsoft 365 authentication. The DMARC generator builds the record.
2. MFA on every mailbox, not only executives. Prefer authenticator apps or hardware keys over SMS where available.
3. Alerts for new mailbox forwarding rules, impossible-travel logins and sign-ins from new devices.
4. External sender banners and display-name impersonation protection in your mail platform.
5. Aggregate DMARC reports to see who is sending as your domain. See DMARC aggregate reports.

Procedural Controls That Stop the Payment

Technology narrows the field. Procedure stops the loss:

• Call-back verification. Confirm any change to bank details or any urgent transfer by phoning a number you already hold, never one from the email.
• Two-person approval above a threshold you set.
• A cooling-off period for first-time payees or changed details.
• No payment changes by email alone, including from the boss.
• A clear escalation route, so staff can question an instruction without fear.

If a Fraudulent Payment Has Already Gone

Speed matters most. Contact your bank immediately and ask them to attempt a recall, then report the incident to the relevant authority. In the United States that is the FBI's IC3 at ic3.gov; elsewhere, your national fraud or cybercrime reporting centre. Preserve the original emails with full headers, which the email header analyzer can help you read. Reset credentials for any account that may be involved. Recovery is never guaranteed, and each hour makes it less likely.

To see what follows beyond the stolen money, read the real cost of email spoofing. If your domain's reputation suffers afterwards, check your email blacklist status.

Frequently Asked Questions

What is the difference between BEC and phishing?

Phishing is usually mass-sent and aims at credentials or malware through links and attachments. BEC is targeted, often has no link at all, and aims at a specific payment or data transfer. The two overlap: phishing is a common way to steal the mailbox access used in BEC.

Can DMARC stop business email compromise?

It stops one technique: exact-domain spoofing of your own domain. It does not stop lookalike domains, display-name spoofing or compromised real mailboxes. Treat it as a necessary layer, not a complete solution.

How do I know if my domain can be spoofed?

Look up your DMARC record. If it is missing, or the policy is p=none, receivers are not instructed to block failing mail. The email security score shows your DMARC status and grade without an account.

Who is most at risk of BEC?

Anyone who pays invoices or handles payroll data, which means almost every organisation. Small businesses face the extra risk of fewer checks and less training, but the FBI's figures cover organisations of all sizes.

What should I do if I receive a suspicious payment request?

Do not reply to the email or use contact details in it. Phone the person or supplier on a number you already have, check the sender address character by character, and escalate to whoever manages IT or finance.

Next Step

Check whether your domain can be spoofed with the free email audit. If you want DMARC enforcement set up without disrupting legitimate mail, see our email security setup service.