Business Email Compromise (BEC)

What Is Business Email Compromise (BEC)?

Business email compromise (BEC) is a type of cyberattack in which a criminal impersonates a trusted person, such as an executive, vendor, or colleague, to trick an employee into transferring money or sharing sensitive information. Rather than breaking through technical defenses, BEC exploits human trust, which is what makes it one of the most costly and effective cybercrimes.

How It Works

A BEC attack usually begins with an attacker either compromising a real email account or creating a convincing lookalike address. From there, they impersonate someone the target trusts and make a request that feels routine, such as paying an invoice, changing banking details, or sending a report.

The most damaging versions involve the attacker quietly monitoring a compromised inbox for weeks, learning how people communicate and when money moves. They then strike at the perfect moment, often just before a legitimate payment, with fraudulent instructions that look entirely believable.

Because BEC relies on deception rather than malware, it frequently slips past technical defenses. There is no malicious attachment for antivirus to catch, just a convincing email. This is why business email compromise caused $2.77 billion in reported losses in 2024 alone (FBI IC3), making it one of the costliest categories of cybercrime.

Why It Matters

BEC is devastating because the losses are direct and often unrecoverable. A single successful attack can redirect a six-figure payment to a criminal, and the money is usually gone by the time anyone notices. For small organizations, clinics, and law firms handling client funds, one attack can be catastrophic. The strongest defense is simple: verify every payment or banking change through a second channel, by phone using a known number, before acting.

Related Terms

• What Is Phishing?
• What Is Social Engineering?
• What Is Multi-Factor Authentication (MFA)?
• What Is a Whaling Attack?

For a complete guide, read our full article on email security for nonprofits.

SecTec helps organizations defend against BEC with email security and staff training as part of our security awareness training service.