CYBER-09-004-P · Primer — Business Email Compromise (BEC)

The idea in one sentence

Business Email Compromise is a fraud where an attacker impersonates an executive or a trusted vendor over email to trick someone into wiring money or changing where payments are sent.

Why it exists

Most security spending goes into stopping malware, yet BEC carries no attachment to scan and no link to block — it is a con game delivered by email, and the target is a human's trust in authority and routine. It works because a wire transfer is a normal, expected event: finance teams pay invoices and honor CEO requests every single day, so a well-timed fake blends into the workflow instead of standing out. The FBI's Internet Crime Complaint Center (IC3) has tracked BEC as one of the costliest categories of cybercrime for years, with reported losses in the tens of billions of dollars — not because the attacks are technically clever, but because they exploit process, urgency, and hierarchy rather than software.

How it works

The attacker first does reconnaissance — reading a company's website, LinkedIn, and out-of-office replies to learn who approves payments, who the vendors are, and when a key executive is traveling. Then they establish a plausible identity through one of two moves: spoofing or look-alike domains (a message from [email protected] when the real domain is acmecorp.com, a swap the eye skips over), or an actual account takeover where stolen credentials let them send from the genuine mailbox and even reply within a real email thread. Finally they send the request — "I'm in back-to-back meetings, please wire the deposit to close this deal today" from a fake CEO, or "our bank changed, here are updated remittance details for this month's invoice" from a compromised vendor. The money moves to an account the attacker controls and is quickly withdrawn or forwarded, often overseas, before anyone notices.

The one gotcha

An email — even from the real address, even mid-thread — is never authorization to move money or change banking details. The single defensive habit that stops nearly every BEC is out-of-band verification: for any new or changed payee, or any urgent transfer, call the requester back on a phone number you already have on file (from a signed contract or your own directory), never a number written in the email itself. That one phone call breaks the con, because the attacker controls the inbox but not the vendor's real phone line — and the urgency in the message is engineered precisely to make you skip the call.

See it (visualization plan)

An ActorSeqScene shows the con: Attacker → Finance ("wire request, bank details changed"), Finance about to pay, then a ChainScene for the defense — "new/changed payee → STOP → call the number on file → confirmed" — and a CompareScene contrasting acmecorp.com with the look-alike acme-corp.com.

See it — A simple flowchart showing BEC steps from reconnaissance to payment

flowchart LR
    A["Reconnaissance<br/>website & LinkedIn"]
    B["Spoof or<br/>Look‑alike domain"]
    C["Fake Invoice<br/>Request"]
    D["Wire Transfer<br/>to Attacker"]
    E["Payment<br/>Completed"]
    A --> B --> C --> D --> E

The one-line takeaway

Verify money changes by phone, not by email.

Where you'll meet it

You will meet BEC in accounts-payable workflows, procurement portals, and payroll systems — anywhere a bank account or a payment can change based on a message. The concrete controls you will help enforce are a call-back policy for vendor bank changes, DMARC/DKIM/SPF to blunt domain spoofing, and dual approval on wires above a threshold. The FBI IC3 recovery guidance is worth knowing too: if a fraudulent wire just went out, report it immediately so banks can attempt a recall — the first 24 to 72 hours are when the money can still be clawed back.

Named concepts: BEC, invoice fraud, wire fraud