Business email compromise (BEC): A highly deceptive and destructive scam
The widespread reliance on email has made it a prime target for cybercriminals. Over the past few years, a form of cyberattack known as business email compromise (BEC) has escalated in frequency and impact, causing significant financial and reputational damage to victim companies.
What is business email compromise?
BEC is an email-based fraud scheme that often unfolds over several weeks or months. Cybercriminals target businesses by infiltrating or mimicking employee email accounts to pose as a known contact or existing supplier. These fraudulent emails request fund transfers to fake accounts. Because the requests appear routine and come from what seems like a trusted source, the victim may unknowingly authorize payments to criminals.
BEC: Business examples
One of the most challenging aspects of BEC is that it’s often months before the target realizes they’ve been a victim of fraud. Below are two examples of how criminals can use BEC to defraud business clients.
A business employee receives an email that appears to be from a vendor but is actually spoofed by a fraudster. The email states that the vendor’s bank account information has changed and provides new payment instructions. Since the email appears to be from a known contact and requests a regularly occurring payment amount, the employee authorizes the payment without suspicion. A few months later, the true vendor notifies the business that they have not received payment.
An HR representative receives an email that appears to be from an internal employee’s email account with new direct deposit instructions for payroll. When the employee contacts HR about not receiving their next expected payroll, the company realizes they are the victim of a hacker.
