Business email compromise (BEC) is the most financially devastating form of cybercrime today. In 2026, BEC attacks account for nearly 19% of all cyber attacks — up from just 1% in 2022 — driven largely by AI tools that make fraudulent emails indistinguishable from legitimate ones. With businesses losing approximately $2.9 billion annually to BEC scams, understanding how these attacks work is essential for anyone who uses email at work.
What Is Business Email Compromise?
BEC is a targeted social engineering attack where criminals impersonate a trusted person — typically a CEO, CFO, vendor, or colleague — via email to trick employees into transferring money, sharing sensitive data, or providing access to company systems. Unlike mass phishing campaigns, BEC attacks are highly personalized and carefully researched.
The FBI classifies BEC into several categories:
- CEO fraud — An attacker impersonates a company executive and emails an employee (usually in finance) requesting an urgent wire transfer
- Vendor impersonation — The attacker poses as a known vendor or supplier and requests payment to a new bank account
- Account compromise — An employee's actual email account is hacked and used to send fraudulent requests to contacts
- Attorney impersonation — The attacker poses as a lawyer or legal representative handling a confidential matter that requires immediate payment
- Payroll diversion — The attacker impersonates an employee and requests HR to change direct deposit information
Why BEC Is So Dangerous
BEC attacks don't use malware, suspicious links, or attachments — they rely purely on social engineering. This means traditional email security filters often can't detect them. The emails look normal because they are normal emails, just sent by someone pretending to be someone else.
How BEC Attacks Have Evolved in 2026
AI has supercharged BEC attacks in several ways:
- Perfect language — AI generates emails that match the writing style, tone, and formatting of the impersonated person. Grammar mistakes and awkward phrasing — once reliable red flags — are gone.
- Voice cloning — Attackers use AI voice cloning to make follow-up phone calls that sound exactly like the impersonated executive, adding a layer of "verification" that makes the scam even more convincing
- Deep research — AI tools scrape LinkedIn, company websites, press releases, and social media to build detailed profiles of targets and their relationships, making impersonation highly personalized
- Speed and scale — AI allows attackers to run multiple BEC campaigns simultaneously, customizing each one for different targets
How to Recognize a BEC Attack
Red Flags in the Email
- Urgency and secrecy — Phrases like "This is time-sensitive," "Don't discuss this with anyone," or "I need this handled before end of day"
- Unusual requests — Any email requesting a wire transfer, payment method change, gift card purchase, or sensitive data that deviates from normal procedures
- Slightly off email addresses — The sender's email may look almost identical to the real address but with subtle differences (e.g., john@companv.com instead of john@company.com)
- Reply-to mismatch — The display name shows a trusted person, but the reply-to address goes elsewhere
- Unusual timing — Requests sent outside business hours, on weekends, or when the supposed sender is known to be traveling or on vacation
Red Flags in the Context
- The "executive" is asking you to bypass normal approval processes
- A vendor is suddenly requesting payment to a different bank account
- An employee is requesting a direct deposit change via email instead of through HR's official process
- The request involves international wire transfers, cryptocurrency, or gift cards
The Two-Channel Rule
Never authorize payments, change banking details, or share sensitive information based on email alone. Always verify the request through a second, independent channel — a phone call to a known number, an in-person conversation, or a message through your company's official communication platform. This single rule stops most BEC attacks.
How to Protect Yourself and Your Organization
1. Implement Payment Verification Procedures
Establish clear policies that require multiple approvals and out-of-band verification for:
- Wire transfers above a certain amount
- Changes to vendor payment information
- New vendor setup
- Payroll or direct deposit changes
2. Enable Email Authentication
Work with your IT team to implement these email security protocols:
- DMARC — Set to "reject" mode (not just "monitor") to prevent domain spoofing
- SPF (Sender Policy Framework) — Specifies which servers can send email on behalf of your domain
- DKIM (DomainKeys Identified Mail) — Adds a digital signature to outgoing emails to verify authenticity
3. Use Multi-Factor Authentication
Enable MFA on all email accounts, financial systems, and business applications. If an attacker compromises an employee's password, MFA prevents them from accessing the account and sending fraudulent emails from it.
4. Train Employees Regularly
BEC training should go beyond generic "don't click suspicious links" advice:
- Run realistic BEC simulations targeting finance, HR, and executive assistants
- Teach employees to verify requests through independent channels
- Create a no-blame culture where employees feel comfortable reporting suspicious emails without fear of punishment
- Update training regularly as attack techniques evolve
5. Limit Public Exposure of Corporate Information
The more information attackers can find about your company online, the more convincing their BEC attacks will be:
- Limit executive personal information available on data broker sites and social media
- Be cautious about sharing organizational charts, reporting structures, and executive travel schedules publicly
- Review what information is publicly available about your company's vendors and financial processes
What to Do If You Fall Victim to BEC
If you suspect a BEC attack has succeeded, act immediately:
- Contact your bank — Request a wire recall immediately. Time is critical — many transfers can be reversed if caught within 24–48 hours.
- Report to the FBI — File a complaint at ic3.gov. The FBI's Recovery Asset Team has recovered millions in BEC losses.
- Notify your IT security team — They need to investigate whether any email accounts have been compromised
- Preserve evidence — Don't delete any emails, messages, or records related to the attack
- Report to law enforcement — File a report with local police in addition to the FBI
Protect Executive Identities with PrivacyOn
BEC attackers rely on publicly available information to craft convincing impersonations. PrivacyOn removes personal information about executives and employees from 100+ data broker sites, reducing the raw material attackers use to research their targets. With dark web monitoring, you'll also know if corporate credentials have been compromised. Plans start at $8.33 per month with family plans for up to 5 people.