Business email compromise

Category hub: Social engineering and human risk

In one sentence: Business email compromise is fraud where a criminal uses a hijacked or faked work email account to trick someone into sending money or data.

What is business email compromise?

The FBI’s Internet Crime Complaint Center describes BEC as a sophisticated scam that targets businesses and individuals who make legitimate transfers of funds. It is frequently carried out by compromising real business or personal email accounts through social engineering or computer intrusion.

The FBI gives everyday examples. A supplier sends an invoice with an updated bank address. A chief executive asks an assistant to buy gift cards. A homebuyer gets wiring instructions that look like they came from the title company. In each case the message was fake.

How it works

The attacker gets access to a mailbox, usually by phishing a password, or builds a look-alike address.
They read real conversations to learn who pays whom and when.
They step in at the right moment with a believable request, often a changed bank account.
They may add inbox rules or forwarding so the real owner does not see replies. Microsoft’s guidance lists suspicious inbox rules and newly added external forwarding as signs of a compromised mailbox.
The money leaves, usually to an account that is emptied quickly.

Who it affects and how badly

The IC3 says BEC targets small local businesses and larger corporations alike.

Sole trader to 10 staff (accountancy, legal, trades): one diverted invoice can be a large share of your cash. Clients may lose trust if the fake email came from your account.
10 to 50 staff (construction, recruitment, estate agents): a redirected supplier or client payment can threaten cash flow. Estate agents and conveyancers handle large one-off transfers.
250 plus and regulated firms: large transfers, plus personal data in compromised mailboxes, which can be an ICO reportable breach.

Real examples

Ubiquiti Inc. In an SEC filing the company said it was the victim of criminal fraud involving “employee impersonation and fraudulent requests from an outside entity targeting the Company’s finance department”, with $46.7 million transferred, of which $8.1 million had been recovered at the time of filing: Krebs on Security quoting the filing.

How to detect it

Review Entra sign-in logs for the account, and check inbox rules with Get-InboxRule -Mailbox <user> -IncludeHidden, as Microsoft’s guidance describes.
Look for new external forwarding and unfamiliar messages in Sent Items.
Treat bank-detail changes and urgent payment requests as alerts in themselves.
Microsoft 365 raises alerts for suspicious email forwarding activity in the Defender portal.

How to fix or prevent it

Confirm every new payee or bank-detail change by phone on a number you already hold.
Turn on multi-factor authentication for all mailboxes.
Require two approvals for large payments.
Disable automatic external forwarding unless there is a business need.
If you find a fraudulent transfer, contact your bank straight away to ask for a recall, as the IC3 advises, and report it to law enforcement.
If a mailbox is compromised, disable it, reset the password, remove malicious rules and review sign-in and audit logs.

Related terms

Frequently asked questions

What is business email compromise?
It is fraud where a criminal uses a hijacked or faked work email account to trick someone into sending money or data.

How do I know if a mailbox has been compromised?
Check inbox rules, new external forwarding and unfamiliar messages in Sent Items, and treat bank-detail changes as alerts in themselves.

What should I do after a fraudulent transfer?
Contact your bank straight away to ask for a recall, as the IC3 advises, and report it to law enforcement.

How Wolfcore helps

Phishy runs realistic phishing simulations against your own staff and shows you who clicked, so you can train the people attackers target. See Phishy phishing simulation.

Service page: Phishy phishing simulation.