What Is Business Email Compromise (BEC)?
Definition
Business email compromise (BEC) is a scam in which criminals break into or impersonate a business email account and use it to trick someone into sending money or sensitive data. The classic version is a "vendor" or "executive" email that changes bank details right before a payment. In FBI complaint data, only investment fraud causes larger reported losses.
How It Works
The FBI's IC3 describes BEC as targeting businesses and individuals who regularly make wire transfers, carried out by compromising email accounts and other channels (phone numbers, virtual meeting apps) through social engineering or computer intrusion. A typical sequence:
- Get a foothold or a disguise. The attacker phishes a real mailbox password (phishing) or sets up a lookalike domain one letter off from your vendor's.
- Watch quietly. With mailbox access, they can read live threads and learn who pays whom, how invoices look, and when money moves. IC3 describes this pattern in real estate deals, where criminals monitor the transaction and time the fraudulent request.
- Make the ask. A believable email asks to update the bank account, switch from check to wire, pay an "urgent" invoice, buy gift cards, or send employee W-2 data.
- Move the money fast. Funds are wired onward through other accounts, often overseas, before anyone notices.
Real-World Example
In December 2019, the U.S. Attorney's Office for the Southern District of New York announced a 60-month prison sentence for Evaldas Rimasauskas, a Lithuanian citizen. From about 2013 through 2015 he registered a company in Latvia with the same name as an Asian computer hardware manufacturer that two U.S. internet companies (a multinational technology company and a social media company) regularly paid. Phishing emails that appeared to come from the real supplier told employees to send payments to his accounts in Latvia and Cyprus. The two companies wired more than $120 million. He was ordered to forfeit $49,738,559.41. If two multinational technology companies could be fooled by a fake supplier email, a 15-person firm can be too.
Why It Matters for a Small Business
IC3 received 24,768 BEC complaints in 2025 with $3,046,598,558 in reported losses, second only to investment fraud. Its September 2024 public service announcement counted 305,033 domestic and international BEC incidents and $55,499,915,582 in exposed losses from October 2013 through December 2023, and notes the scam targets everyone from "small local businesses to larger corporations." IC3 also reported that in 2025 businesses lost more than $30 million to BEC scams involving AI, which can produce convincing executive-style emails.
For a small business, a single redirected payment can equal a month of revenue, and banks are not always able to claw it back.
How to Spot It / How DTS Handles It
Warning signs: any email that changes payment instructions; pressure for speed or secrecy; a sender domain that is almost right; a reply-to address that differs from the sender; or mailbox rules you did not create that forward or hide messages. The best defense is procedural: confirm every bank change by calling a number you already have on file, never the one in the email.
If money has already moved, IC3's guidance is to contact your bank immediately to request a recall, then file a complaint at ic3.gov regardless of the amount. DTS then secures the mailbox, reviews sign-ins and rules, preserves the message headers, and checks who else the attacker emailed. See our business email compromise response page.
Related Terms
- Phishing: the usual way attackers get the mailbox password.
- Account takeover: BEC often starts with a taken-over Microsoft 365 or Google account.
- Multi-factor authentication (MFA): makes a stolen password far less useful.
- DMARC: helps stop criminals spoofing your exact domain.
- Incident response: the steps to take in the first hour after a bad wire.
- Chain of custody: keeping the fraudulent emails and headers usable as evidence.
Sources
- FBI Internet Crime Complaint Center, PSA I-091124-PSA, Business Email Compromise: The $55 Billion Scam (September 11, 2024): https://www.ic3.gov/PSA/2024/PSA240911
- FBI Internet Crime Complaint Center, 2025 IC3 Annual Report (BEC counts, losses, AI section, definitions): https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- U.S. Attorney's Office, Southern District of New York, "Lithuanian Man Sentenced To 5 Years In Prison For Theft Of Over $120 Million In Fraudulent Business Email Compromise Scheme" (December 19, 2019): https://www.justice.gov/usao-sdny/pr/lithuanian-man-sentenced-5-years-prison-theft-over-120-million-fraudulent-business
Last updated October 14, 2026.