Business Email Compromise (BEC)

The FBI's Internet Crime Complaint Center (IC3) describes BEC as a scam that targets businesses and individuals who make legitimate funds transfers. It is frequently carried out by compromising real business or personal email accounts through social engineering or computer intrusion. Some variants use a compromised account to request employees' personally identifiable information for use in other scams. In thread hijacking, an attacker with access to an email account replies inside an existing conversation so the request looks legitimate.

BEC is one of the most common and costly social engineering schemes targeting organizations. IC3 counted 305,033 domestic and international incidents with more than $55 billion in exposed losses between October 2013 and December 2023, and the scam has been reported in all 50 US states and 186 countries.

IC3 recommends verifying requests to change account information through a secondary channel or two-factor authentication, checking that the URL and sender address in an email match who it claims to come from, watching for misspelled domain names in links, and not sending login credentials or personal information by email. The NCSC advises making sure staff know the normal way key tasks such as payments are made, so fraudulent requests stand out. When a fraudulent transfer is discovered, the victim should immediately ask the financial institution to recall the funds and file a complaint at ic3.gov regardless of the amount lost.