What Is Business Email Compromise (BEC)?

Business Email Compromise (BEC) is a fraud where an attacker uses email — often from a real, hijacked account — to trick someone in your company into sending money or sensitive data. There is usually no malware and no malicious link to catch. The attacker impersonates a CEO, vendor, or trusted colleague and relies on authority, urgency, and a plausible story to get an employee to authorize a wire transfer, change banking details, or release payroll information. It is con artistry delivered over email, and it is one of the costliest cybercrimes affecting SMBs.

The attacker spoofs or hijacks an executive's email and pressures a finance or admin employee to make an urgent payment — "I'm in a meeting, just get this wire out before end of day, I'll explain later." The message exploits the natural reluctance to question the boss. Because it comes from (or looks like) a real leader's address, it sails past technical defenses aimed at malware.

Also called supply-chain invoicing fraud, this is the most financially damaging variant. The attacker compromises or impersonates a legitimate vendor, then sends an invoice or a "we've updated our banking details" notice. Payment goes to the attacker's account. Because there is a real ongoing business relationship, these requests look completely routine.

When an attacker actually controls a real mailbox — typically via a phished password and no MFA — BEC becomes far more dangerous. They read real threads, learn how people communicate, set hidden inbox rules to hide their replies, and insert themselves into live conversations about real payments. This is the hardest variant to spot because the email genuinely is from the right person.

Traditional email security looks for malicious attachments, dangerous links, and known-bad senders. A BEC message has none of those — it is plain text from a legitimate-looking or genuinely compromised address. There is nothing for a signature-based filter to detect, which is exactly why BEC has overtaken malware as the leading cause of financial loss in email attacks.

Phishing casts a wide net to harvest credentials or drop malware, usually with a link or attachment. BEC is targeted social engineering aimed directly at moving money or data, often with no link at all. The two connect: a successful credential-phish is frequently the first step that gives an attacker the mailbox access needed to run a high-trust BEC scam from the inside.