Business Email Compromise Protection | The Complete Guide
Continue Reading
November 4, 2026
A privileged access management system controls, records, and limits admin access. See how PAM works, where it fits with IAM, and how to roll it out.
October 27, 2026
Learn how API security testing works: OWASP API Top 10 coverage, an 8-step method, a copy-ready checklist, sample test cases, and CI/CD placement for teams.
October 23, 2026
Learn what cloud security posture management (CSPM) is, how it works, key capabilities to demand, and a six-phase rollout plan for AWS, Azure, and GCP.
Business email compromise (BEC) is a fraud in which an attacker poses as a trusted person, such as an executive, vendor, or colleague, to trick an employee into sending money or sensitive data. It relies on deception rather than technical exploitation, so it is as much a scam as a cyberattack.
BEC is hard to stop because the typical message carries no malware, malicious link, or attachment. Filters built to catch those signals have little to flag. The email may come from a legitimate account the attacker has already taken over, can pass authentication checks, and often references a real invoice or project. The FBI's Internet Crime Complaint Center (IC3) reported roughly $3.05 billion in BEC losses for 2025, making it the second-costliest crime type in its annual report after investment fraud. Effective business email compromise protection therefore depends on payment-verification processes and account security working alongside email filtering, not on filtering alone.
Business email compromise (BEC) is a scam in which an attacker uses email to impersonate someone the victim trusts, then asks for a payment, a change to payment details, or sensitive information. The FBI defines it as a scam that targets businesses and individuals by impersonating someone and requesting a payment, a change to payment details, or sensitive information.
BEC is email fraud built around a believable request. An attacker either creates a convincing fake identity or takes over a real email account, then asks someone with authority over money or data to act. The request is usually ordinary on its face: pay this invoice, update these bank details, send me the payroll file.
What separates BEC from most email threats is that nothing needs to be "installed." The attack works if the recipient trusts the sender and acts. According to the FBI's Internet Crime Complaint Center (IC3), the fraud is carried out either through social engineering or through computer intrusion that gives the attacker access to a legitimate mailbox. Either way, the end goal is an unauthorized transfer of funds.
"BEC scam" and "BEC attack" describe the same threat from two angles. Law enforcement and financial institutions tend to say scam because the harm is fraud against the victim. Security teams tend to say attack because it involves an adversary, a technique, and an entry point such as a hijacked mailbox, as it does in other cyber security attacks. You may also see "email account compromise" (EAC), which the FBI pairs with BEC and which emphasizes the stolen account rather than the impersonation. In practice, the terms are interchangeable: someone deceives a person through email into moving money or data they should not.
BEC targets people with authority over money, payroll, or sensitive records, and it mostly impersonates executives rather than attacking them directly. Finance and accounts payable staff can release payments or change vendor bank details. HR and payroll staff can redirect salaries or hand over employee tax and identity data. Executives and their assistants matter because their names carry authority: a request that appears to come from the CEO gets acted on quickly and questioned rarely.
No size, sector, or region is exempt. IC3 data shows BEC reported in all 50 U.S. states and 186 countries, with fraudulent transfers received in more than 140 countries. Attackers choose roles, not companies, because the same fake invoice or urgent wire request works wherever someone can approve a payment without a second check.
A BEC attack works in four stages: the attacker researches a target, assumes a trusted identity, builds a believable reason to act, and then asks for payment or data. Each stage is cheap on its own, and the fraud succeeds only if one person at the end acts without verifying.
BEC begins with research because the request must match how the victim's business actually operates. Attackers read company websites, press releases, and LinkedIn profiles to learn who approves payments, who reports to whom, and which vendors or law firms the company works with. Public contract announcements, conference schedules, and out-of-office replies fill in the rest. The goal is a short list of people and relationships to imitate, not a technical weakness to exploit.
The attacker needs an email identity the victim will accept, and there are three ways to get one. Spoofing forges the sender name or address so a message appears to come from a known person, which works best against domains without strict email authentication. A lookalike domain is a real, registered address that differs by a character or two, such as swapping "m" for "rn." The third and most dangerous route is a compromised real mailbox, usually obtained through phished credentials or passwords reused from earlier breaches. In that case the email genuinely comes from the legitimate account. Leaked credentials are a common starting point, and dark web monitoring can show whether yours are already circulating.
The pretext is the story that makes the request feel normal and urgent. It typically combines authority (the message appears to come from a senior person), urgency (a deadline, an acquisition, a supplier threatening to stop delivery), and secrecy (instructions to keep the matter confidential or avoid calling). Attackers also pick moments when verification is harder, such as when an executive is traveling, at month-end close, or around holidays. Secrecy matters most, because it discourages the one step that would expose the fraud: asking someone else.
The final request is almost always routine. It asks for a wire transfer, a change to a vendor's bank details, a redirected payroll deposit, gift card purchases, or a file containing employee or customer records. Verizon's 2024 Data Breach Investigations Report puts the median BEC transaction at around $50,000, which is large enough to matter but small enough to slip under approval thresholds designed for bigger payments. Stolen funds are typically moved quickly through intermediary accounts, so the window to recall a transfer is short. That is why the FBI advises victims that time is of the essence.
Mailbox takeover is more dangerous because the fraudulent email is, technically, a real one. It is sent from the genuine account and the genuine domain, so it passes SPF, DKIM, and DMARC checks that would catch a forged sender. A spoofed message can often be blocked by enforcing email authentication on your domain. Lookalike domains and compromised accounts cannot.
A takeover also gives the attacker context. They can read existing threads, learn how people write to each other, and reply inside a real conversation about a real invoice. Attackers often create inbox rules that hide replies from the account owner, letting the fraud continue unnoticed. The same compromised account can also be used against the company's vendors and customers, so one stolen login can lead to several victims.
BEC attacks fall into a handful of recurring types, defined by who the attacker impersonates and what they ask for. The FBI recognizes five core categories (bogus invoice, CEO fraud, account compromise, attorney impersonation, and data theft), and newer variants such as payroll diversion, gift card requests, and crypto wallet swaps follow the same pattern. The table below summarizes each type and the control most likely to stop it.
Type | Who Is Impersonated | What Is Requested | Control That Blocks It |
|---|---|---|---|
CEO or Executive Impersonation | CEO, CFO, or other senior executive | Urgent, confidential wire transfer | Dual approval and callback verification for payments above a set threshold |
Vendor Email Compromise and Invoice Fraud | Established supplier or vendor | Payment to new or updated bank details | Verify bank-detail changes by phone using a number already on file |
Payroll Diversion | An employee | Change of direct-deposit account | Employee self-service portal changes, with confirmation sent to the old contact |
Attorney and Real-Estate Closing Fraud | Lawyer, title agent, or closing agent | Time-sensitive funds transfer or revised wire instructions | Confirm wire instructions by phone using an independently sourced number |
Gift Card and Data-Theft Variants | Executive, manager, or HR contact | Gift card purchases or employee and tax records | Written policy against gift card requests by email; restricted release of HR data |
Crypto and Wallet-Address Swap | Counterparty, vendor, or internal finance contact | Transfer to a changed wallet address | Pre-approved withdrawal address allowlist with out-of-band confirmation |
In CEO or executive impersonation, the attacker poses as a senior leader and asks someone in finance to make an urgent, confidential payment. It works because few employees want to question an instruction that appears to come from the top. The request usually arrives when the real executive is traveling or in meetings, which explains the "I can't talk right now" framing. The decisive control is procedural: payments above a threshold require a second approver and a callback to the executive on a known number, no matter how senior the apparent sender is.
Vendor email compromise and invoice fraud involve an attacker posing as a real supplier and asking to be paid into a different bank account. The invoice is often genuine or closely copied, so the only thing that changes is where the money goes. This type is hard to catch because it blends into normal accounts-payable work. The best defense is a rule that any change to vendor payment details must be verified by phone using contact details already on file, never those in the email requesting the change.
Payroll diversion is a scam in which an attacker poses as an employee and asks HR or payroll to switch their direct deposit to a new account. The request is small, which helps it avoid scrutiny, and the loss often goes unnoticed until the real employee misses a paycheck. Requiring changes through an authenticated employee portal, with confirmation sent to the existing contact details, removes the email request as an attack path.
Attorney and real-estate closing fraud targets deals with time-sensitive, large payments. The attacker poses as a lawyer, title company, or closing agent and sends altered wire instructions shortly before the closing. The amounts are often much larger than in other BEC types, and the timing leaves little room for second-guessing. The standard safeguard is to verify wire instructions by phone, using a number found independently rather than in the email thread.
Gift card and data-theft variants ask for something other than a wire transfer. In the gift card version, a fake executive asks staff to buy cards and send the codes. In the data-theft version, the attacker asks HR or finance for employee records, tax forms, or customer lists, which are then used for identity fraud or to make later BEC attempts more believable. Clear written policies, such as "we never request gift cards by email" and limits on who can release sensitive records, remove most of the room to maneuver.
Wallet-address swap fraud is a BEC variant in which an attacker, posing as a counterparty, vendor, or internal finance contact, sends a changed crypto wallet address for a payment or settlement. It matters most for Web3, exchange, and fintech firms, where transfers are routine and, once confirmed on-chain, generally cannot be recalled. Prevention is therefore the only reliable defense. Firms should keep an allowlist of pre-approved withdrawal addresses, require out-of-band confirmation for any change, and add a cooling-off period before first payments to a new address.
The three scenarios below show how a business email compromise attack typically plays out and where it can be stopped. They are composites built from the patterns the FBI describes, not real incidents. IC3 recorded more than 305,000 BEC incidents between October 2013 and December 2023, so these patterns repeat constantly rather than appearing as exotic one-offs.
A mid-sized manufacturer's accounts payable clerk receives an email from a long-standing parts supplier. It says the supplier has changed banks and asks that the next invoice, a routine five-figure amount, be paid to the new account. The email is polite, references the correct purchase order, and comes from an address that differs from the real one by a single character.
The clerk updates the vendor record and pays the invoice. The fraud surfaces weeks later, when the real supplier asks why payment is overdue. The tell was the changed bank details arriving by email, which should always trigger verification. A callback to a phone number already on file would have exposed it before any money moved.
A finance manager gets an email that appears to come from the company's CEO, who is traveling. It says an acquisition is about to close, that the matter is confidential, and that a deposit must be wired today to a law firm's account. The message tells the manager not to discuss it with anyone and to reply only by email because the CEO is in meetings.
The manager complies because the instruction seems to come from the top and the deadline is real-sounding. The red flags were all in the pretext: urgency, secrecy, and a ban on verification. A rule that every transfer above a set amount needs a second approver and a callback to the executive on a known number would have stopped it, regardless of who appeared to send the request.
A property buyer and a real-estate agent have been exchanging emails for weeks about an upcoming closing. Unknown to both, the agent's mailbox was compromised earlier through a phished password. The attacker has been reading the thread and, days before closing, replies inside it with "updated wire instructions" for the closing funds. The reply stays in the same conversation, uses the same tone, and comes from the agent's real address.
Nothing about the message looks out of place, so the buyer sends the funds to the attacker's account. This is the hardest type to catch because the email passes every technical check and the context is real. The control that works is process-based: confirm any new or changed wire instructions by phone, using a number obtained independently of the email thread.
The most reliable current figures come from two sources: the FBI's Internet Crime Complaint Center (IC3) 2025 annual report for losses, and Verizon's 2026 Data Breach Investigations Report (DBIR) for how often social engineering leads to breaches. IC3 recorded 24,768 BEC complaints and about $3.05 billion in losses for 2025. Verizon found the human element present in 62% of breaches.
Year | BEC Complaints | BEC Reported Losses |
|---|---|---|
2025 | 24,768 | $3,046,598,558 |
2024 | 21,442 | $2,770,151,146 |
2023 | 21,489 | $2,946,830,270 |
Dividing 2025 BEC losses by BEC complaints gives roughly $123,000 per complaint, compared with an overall average loss of $20,699 across all IC3 complaint types. This gap helps explain why BEC draws attention despite its low complaint volume. The report also notes that some BEC now involves AI, with more than $30 million in losses tied to AI-related BEC complaints, and it adds that not all BEC tactics are AI-enabled.
Verizon's 2026 DBIR, covering incidents from November 2024 through October 2025, found the human element in 62% of breaches, up from 60% the year before. Social engineering was the third most common breach pattern, at 16%. Pretexting, the tactic behind most BEC, was the initial access vector in 6% of all breaches, compared with 16% for phishing.
BEC sits at the boundary between the two. Verizon describes BEC-style attacks as phishing followed by pretexting, because a person is on the other end of the email thread. In Verizon's email gateway data, BEC-style messages were about 3% of blocked email attacks, against 80% for plain phishing. Because the DBIR counts confirmed data breaches, fraud that moves money without exposing data may not appear in these percentages.
Treat every BEC statistic as a floor, not a total. IC3 figures come from complaints victims choose to file, and the report states its statistics are a point-in-time assessment that may change. Duplicate filings are possible, and BEC counts include people aged 60 and older who may be reporting on behalf of a business.
Trend comparisons need care for three reasons:
2024 was a dip. BEC losses fell from $2.95 billion in 2023 to $2.77 billion in 2024 before rising to $3.05 billion in 2025, so "up 10% on 2024" overstates the longer trend.
The datasets differ. IC3 reports on the calendar year, Verizon on November through October, and the two count different things (complaints and losses versus confirmed breaches).
Classification changes shift trends. Verizon added pretexting as a tracked initial access vector in 2026, which lowered credential abuse from 22% to 13% (it would have been 16% without the change).
Do not combine the FBI's cumulative "exposed loss" figures, which include attempted losses, with annual adjusted losses.
Phishing tries to trick many people into handing over credentials or running something malicious, while business email compromise (BEC) tries to trick a specific person into sending money or data. The two often work together, but they call for different defenses.
Comparison | Phishing | BEC (Business Email Compromise) |
|---|---|---|
Attack Goal | Steal credentials or deliver malware | Redirect a payment or obtain sensitive data |
Payload | Malicious link, attachment, or fake login page | Usually none; the request itself is the attack |
Detectability | Filters can flag known-bad links, files, and senders | Low; the message looks like routine business email |
Typical Control | Email filtering, link and attachment scanning, MFA, and awareness training | Payment verification procedures, email authentication, and mailbox monitoring |
BEC messages often contain nothing a scanner can detonate or blacklist, because the payload is a plain-text request such as "update these bank details." Verizon's 2026 Data Breach Investigations Report shows how email defenses skew toward volume threats. In its email gateway data, about 80% of blocked attacks were plain phishing and 10% carried malware, while BEC-style messages made up about 3%.
Verizon also draws a useful distinction: phishing is asynchronous, a message sent in hope of a click, while BEC typically involves a live exchange with a person on the other end. That is why the two need different training and controls. Verification rules for payments and bank-detail changes matter more here than link-checking advice.
Phishing frequently comes first in a BEC attack. The FBI describes BEC as compromising email accounts through social engineering or computer intrusion, and credential-phishing emails are a common route into a real mailbox. Verizon describes BEC-style attacks as phishing followed by pretexting. Once the attacker controls a legitimate account, the follow-up request carries no phishing indicators, because it comes from a real sender in a real conversation.
This overlap has a practical consequence: stopping credential theft with phishing-resistant MFA closes one of the main paths into BEC. For a deeper look at recognizing and training against phishing itself, see our cyber security awareness guide.
The clearest signs of business email compromise are a request that combines urgency with secrecy, a change to payment details, a sender address that is slightly off, and unexplained changes in the mailbox itself, such as new forwarding rules or sign-ins from unusual places. Any one of these can be innocent, but a payment request that shows two or more should be verified before anyone acts.
The strongest message-level red flag is pressure to act quickly and quietly. A BEC email typically asks for something that bypasses normal process: pay this today, keep it confidential, do not call because I am in meetings. A changed bank account, a new payee, or an instruction to switch to a different payment method is the most important content to treat as suspicious, because it is where the money actually moves.
Timing and channel matter too. Requests that arrive outside the sender's usual working hours, just before a deadline, or while the supposed sender is known to be traveling fit the pattern. So does a request to move the conversation to personal email or text. Do not rely on spelling mistakes as a signal. Generative AI can produce fluent, convincing messages, and the FBI's 2025 report notes that chat generators can quickly create official-sounding emails that mimic a CEO or other officials.
A BEC sender often looks right at a glance and wrong on inspection. The display name matches a real executive or vendor, but the address behind it is different, or the domain differs by a single character, such as "rn" in place of "m." Check the full address, not only the name shown in the inbox.
A reply-to mismatch is another common sign: the message appears to come from one address, but replies go to another. Newly registered domains and first-time senders asking for payment deserve extra scrutiny. If the email comes from a genuinely compromised mailbox, none of these sender checks will fire, because the address is real. That is why the message and technical signs also matter.
The most telling technical sign is a mailbox change the owner did not make. Look for new inbox rules that move or delete messages containing words like "invoice" or "payment," auto-forwarding to an external address, newly authorized apps, and changes to MFA settings. Attackers use rules like these to hide replies and keep control of a conversation.
Sign-in logs add a second layer. Logins from unfamiliar countries or devices, and "impossible travel," where the same account signs in from two distant locations to close together in time, suggest someone else is using the credentials. Any of these on an account that handles payments should trigger an immediate password reset and session revocation.
Speed matters once a sign is confirmed. In 2025, the FBI's Financial Fraud Kill Chain process, which helps freeze stolen funds across fraud types, froze $679 million of $1.16 billion in attempted theft across 3,900 incidents, a 58% success rate. The FBI recommends contacting your bank immediately and filing a complaint at ic3.gov.
BEC detection combines three layers: checking email authentication results (SPF, DKIM, DMARC), monitoring mailboxes for suspicious changes and sign-ins, and using behavioral analysis to flag unusual requests. No single layer catches every variant, because each one covers a different part of the attack.
Email headers show whether a message was sent by who it claims to be from. SPF checks that sending server is authorized for a domain, DKIM verifies a cryptographic signature that the domain applied to the message, and DMARC requires SPF or DKIM to pass and align with the visible "From" domain. The "Authentication-Results" header records the outcome, so a dmarc=fail or an alignment mismatch is a strong sign of a spoofed sender. A mismatch between the From address, the Return-Path, and the Reply-To address is worth checking in the same place.
These checks have clear limits. A lookalike domain passes authentication for its own domain, and a message from a compromised legitimate account passes everything. A "pass" means the message was properly authenticated, not that the request is genuine.
The most reliable detection signals for account takeover are changes inside the mailbox itself. Alert on newly created inbox rules, especially those that delete, archive, or mark messages as read, or that match words such as "invoice" or "payment." Alert on external auto-forwarding, on new OAuth app consents that request mail access, and on changes to MFA methods. Add sign-in monitoring for unfamiliar devices or countries, impossible travel, and sessions that look replayed. A domain data breach scan can also show whether your domain's credentials have already leaked, which helps explain sign-ins that otherwise look legitimate.
Microsoft documented how attackers behave after taking over a mailbox in an adversary-in-the-middle phishing campaign that targeted more than 10,000 organizations from September 2021. The attackers created inbox rules to send replies from fraud targets to the archive folder, and they updated the rule each time they found a new target organization. In some cases, session cookies carried an MFA claim, so a sign-in could look strongly authenticated while still being fraudulent. That is why rule changes need alerts of their own, and why session context matters as much as the login event.
Behavioral detection learns who normally emails whom, how payment requests are worded, and when they are sent, then flags deviations such as a first-time payee, a bank-detail change from a known vendor, or an unusual tone from an executive. It can catch BEC messages that have no link, no attachment, and clean authentication.
It also has real weaknesses. False positives are common because legitimate bank changes, new vendors, and executives writing at odd hours all look unusual, and alert fatigue trains people to ignore them. Blind spots are the bigger concern: a compromised real account writing inside an existing conversation looks normal by design, and an attacker who has been in a mailbox for weeks can learn its patterns. Detection scores are best used to buy time, not to replace verification. A bank-detail change should be confirmed by a call to a known number whatever risk score the message receives.
The most effective protection against business email compromise is a payment process that never depends on trusting an email, supported by phishing-resistant MFA, enforced email authentication, and a hardened mailbox. The controls below are ranked by how many BEC attack paths each one blocks, starting with the broadest.
Out-of-band verification and dual approval are the only controls that work whether the attacker spoofs a sender, registers a lookalike domain, or takes over a real mailbox. They remove the attacker's payoff instead of trying to spot the email. The rule is simple: any new payee, changed bank detail, or unusual payment request is confirmed by calling a number already on file, never one from the request itself, and payments above a set threshold need a second approver. Write the rule into your information security policy so it applies to everyone, including executives. Nothing else on this list stops a request that comes from a genuine, compromised account. Then test it: a red team exercise that sends a simulated BEC-style request shows whether staff follow the callback rule under real pressure.
SPF, DKIM, and DMARC at enforcement stop attackers from sending email that appears to come from your exact domain. Moving DMARC from monitoring (p=none) to quarantine or reject, once SPF and DKIM are aligned for all legitimate senders, makes direct spoofing of your executives and finance team much harder for customers and vendors to pull off. It also has hard limits: it does nothing about lookalike domains or compromised accounts, so it ranks below process controls. Your own mail gateway should also honor other domains' DMARC policies on inbound mail.
Phishing-resistant MFA, meaning FIDO2 security keys or passkeys, blocks the credential theft that leads to mailbox takeover, which is the most damaging BEC path. These authenticators are bound to the real website, so a fake login page or adversary-in-the-middle proxy cannot capture something usable. SMS codes and push approvals can be phished or relayed, which is how the adversary-in-the-middle campaigns described earlier got past MFA. Prioritize finance, executives, executive assistants, and administrators first (seeprivileged access management), and pair MFA with conditional access in line with a zero trust approach, because stolen session tokens can still be a weak point.
Mailbox hardening limits what an attacker can do and how long they can stay hidden after a compromise. Disable legacy authentication protocols that bypass MFA, block or restrict automatic forwarding to external addresses, and alert on new inbox rules and new OAuth app consents. These settings don't prevent the first intrusion, but they make it much harder for an attacker to hide replies and quietly monitor payment threads.
Lookalike domain monitoring blocks the one path that authentication cannot: fraudulent domains that differ from yours or a vendor's by a character or two. Watch newly registered domains and certificate issuances that resemble your brand and your key suppliers, register the most obvious variants yourself, and flag external senders whose display names match internal staff. It will never cover every variation, so treat it as early warning that supports verification, not as a barrier. It is one part of broader external attack surface management.
Awareness training helps most when it targets the people who can move money and the rules they follow, not general email hygiene. Verizon's 2026 DBIR found a median click rate of 1.4% in email phishing simulations and about 2% in phone-based ones, though the phone sample was small. Verizon also notes that defending against pretexting needs business rules tailored to each target group. For finance, accounts payable, payroll, and executive assistants, that means rehearsing the callback and dual-approval procedures above. For program design, see our security awareness training guide.
Require callback verification and dual approval for new payees, bank changes, and payments above a threshold.
Publish SPF and DKIM for every legitimate sender, then move DMARC to quarantine or reject.
Deploy FIDO2 or passkey MFA for finance, executives, assistants, and admins.
Disable legacy authentication and block external auto-forwarding.
Alert on new inbox rules, forwarding changes, OAuth consents, and risky sign-ins.
Monitor lookalike domains for your brand and your top vendors.
Run role-specific training for finance and executive-assistant staff.
Keep a written plan for recalling a fraudulent transfer, including bank and IC3 contacts.
If you suspect a BEC attack, contact your bank immediately to request a recall of funds, then lock down the affected mailbox, report the incident to law enforcement, and preserve the evidence. Speed matters most in the first hour, because stolen funds are usually moved quickly.
Call your bank's fraud or wire team. Provide the transaction details and ask them to recall the transfer. The FBI also advises requesting any indemnification paperwork your bank requires.
Alert your internal finance lead and security contact. This stops further payments on the same pretext.
Capture the mailbox state, then contain it. Export the inbox rules, forwarding settings, and recent sign-in logs, then reset the password, revoke active sessions and tokens, and remove unauthorized rules, forwarding, and app grants.
Warn the people being impersonated. Tell the vendor, executive, or attorney whose identity was used, so they can warn their own contacts.
The FBI's 2025 report includes an August case in which homebuyers wired more than $449,000 to a fraudulent account after receiving an email posing as their attorneys. They reported it to their bank, and the complaint filed with IC3 allowed the Bureau's recovery team to ask the recipient bank to freeze the funds. The recipient bank reported that the full amount was still in the account, on hold.
In the United States, file a complaint at ic3.gov regardless of the amount, and include the full transaction details so IC3 can help financial institutions and law enforcement freeze funds. Outside the US, report to your national cybercrime reporting channel or local police, and give the same transaction details to your bank. If your organization is regulated, or a contract or insurance policy requires notification, check those obligations early, because they often carry short deadlines.
Preserve evidence before it is overwritten. Keep the original fraudulent emails in their original form, including full message headers, rather than forwarding or printing them. Save the wire confirmation and bank correspondence, export mailbox audit and sign-in logs (many platforms keep them for a limited time), and record who did what and when. Avoid wiping or rebuilding the affected account until your security team or legal counsel confirms that the evidence is captured. For the wider response process, including containment, scoping, and recovery, see our incident response guide.
BEC risk rises for organizations that move money across borders, languages, and time zones, because each gap gives an attacker more room to impersonate a trusted party and more reasons for a victim to skip verification. GCC firms with international suppliers, investors, and banking partners face this pattern every day.
Cross-border payments help attackers because verification is slower and recovery is harder. A request that lands at the end of a counterpart's business day, or when weekend patterns differ between countries, is likely to be approved by someone who cannot easily reach the sender or the second approver. Differences in banking hours and public holidays across the GCC and Western counterparts add more windows.
Recovery also takes more coordination once funds leave the country. The FBI's 2025 report shows how this looks in practice: its recovery team handled 3,574 domestic freeze requests and 326 international ones across all fraud types, and the international process required coordination with FinCEN and FBI legal attachés. Cross-border BEC cases take more parties to unwind, which is why prevention and fast reporting matter even more.
Banks and fintechs licensed by the Central Bank of the UAE (CBUAE), government-linked entities under the UAE Signals Intelligence Agency (SIA, formerly NESA), and virtual asset firms licensed by Dubai's VARA each answer to a regulator that sets security and incident-handling expectations. A BEC loss can therefore trigger notification, audit, or customer-protection duties on top of the financial damage. Confirm current obligations with your compliance team, and see our guide to UAE cybersecurity regulations for the wider landscape.
Attackers increasingly write convincingly in the target's language. Verizon's 2026 DBIR notes that AI assistance can lift less experienced attackers to a higher baseline of proficiency in English or the target language of a social attack, which removes the broken-grammar tell that used to help in cross-language fraud. In a region that works across Arabic and English, expect fluent impersonation in either language, mixed-language threads, and vendor or executive names that appear in several transliterations, which makes a slightly altered name look like an ordinary spelling variant.
Cross-jurisdiction setups add a second layer. A supplier in another country, a payment routed through an intermediary bank, or a vendor in a different regulatory zone can make an unusual bank-detail change look plausible. The defense is the same everywhere: call a known contact before changing payee details, no matter how convincing the language or context.
No. Phishing tries to trick many people into giving up credentials or running something malicious, while BEC tries to trick a specific person into sending money or data. The FBI's IC3 tracks them as separate crime types, and the impact differs significantly. In 2025, IC3 recorded 191,561 phishing/spoofing complaints with $215.8 million in reported losses, against 24,768 BEC complaints with $3.05 billion. The two connect because phishing often compromises a mailbox before the BEC request is sent.
Only partly. Filters catch spoofed senders, known-bad links, and malicious attachments, but many BEC emails contain none of these. A message sent from a compromised real account, or from a convincing lookalike domain, may pass every automated check. Filters belong in the defense, but payment verification procedures and mailbox monitoring are what close the gap.
Sometimes, especially if you report quickly. The FBI's Financial Fraud Kill Chain process, which asks banks to freeze fraudulent transfers, handled 3,900 incidents in 2025 and froze $679 million of $1.16 billion in attempted theft, a 58% success rate across all fraud types, not BEC alone. Recovery is never guaranteed, and money that has been moved onward or converted is harder to freeze. Contact your bank first, then file a complaint at ic3.gov.
MFA stops many BEC attacks but not all of them. It blocks attackers who rely on a stolen password alone, which is a common route to mailbox takeover. However, adversary-in-the-middle phishing can steal session cookies and bypass SMS or push-based MFA, as Microsoft documented in a campaign that targeted more than 10,000 organizations. Phishing-resistant methods such as FIDO2 keys or passkeys are the stronger choice. MFA also does nothing against a request from a lookalike domain or a fake invoice, so pair it with payment verification.
Act immediately, ideally within hours. The FBI's guidance is that time is of the essence: contact your financial institution immediately to request a recall of the funds, provide any indemnification documents the bank requires, and file a complaint at ic3.gov with the full transaction details, regardless of the amount. Every hour gives the attacker more time to move the money onward.
Not automatically. BEC is usually fraud that tricks someone into sending money, and it can happen without accessing any confidential data. It becomes a data breach when an attacker also gains access to a mailbox and views or takes personal or confidential information. Verizon defines a breach as an incident with confirmed disclosure of data to an unauthorized party. Whether you must notify regulators or affected people depends on your jurisdiction and the data involved, such as under the UAE data protection law, so check with legal counsel early.