Help us build a better business for our people & customers.
Key Points
Business email compromise is an impersonation-based scam that uses trust and social engineering to steal money or sensitive information through email.
BEC attacks often target executives, finance teams, HR staff, and business partners through tactics like CEO fraud, CFO fraud, W-2 theft, and gift card scams.
BEC is especially dangerous because attackers can use compromised or spoofed accounts to make fraudulent requests look legitimate and urgent.
Reducing BEC risk requires a layered strategy that combines employee awareness, email authentication, threat detection, and real-time analysis of suspicious messages.
BEC now costs organizations more than any other form of cybercrime the FBI tracks, except investment fraud. Here's how the scams work, how they've evolved, and what actually reduces the risk.
What is business email compromise?
Business email compromise attacks are impersonation scams. Attackers pose as a senior executive, a trusted colleague, or one of the organization's business partners, often using lookalike email addresses that are nearly identical to the real ones, then use that borrowed authority to redirect money or sensitive information. Sometimes it involves compromising a real business email account, but more often it's accomplished through social engineering alone, no hacking required.
For example, an attacker may convincingly masquerade as a CEO in an email, telling an accounting employee to wire money to a "supplier." In reality, it's a fraudulent account controlled by the attacker. In another common variant, attackers intercept an email thread between a company and its supplier, then quietly substitute their own account numbers for the supplier's.
BEC vs. email account compromise (EAC)
BEC is closely related to email account compromise (EAC), where an attacker does not just imitate someone but actually gains control of their real email account. Because a compromised account carries genuine message history, contacts, and writing style, EAC based BEC attacks are often harder to catch than a spoofed message.
The scale of the problem
BEC remains one of the costliest categories of internet crime the FBI tracks. According to the FBI's 2025 Internet Crime Report, the Bureau's Internet Crime Complaint Center (IC3) logged 24,768 BEC complaints in 2025, totaling $3.05 billion in reported U.S. losses, up from $2.77 billion in 2024. Globally, cumulative exposed BEC losses have topped $55 billion since 2013, spanning more than 140 countries.
How does business email compromise work?
Business email compromise is an exploit through which attackers obtain access to or convincingly imitate a business email account, then use it to pose as its owner. This is usually done to defraud the company, its employees, customers, or partners. The attacker sends a message designed to trick the recipient into sending money or other resources or divulging confidential information.
Business email compromise examples
As a cyber threat, BEC attacks take many forms, limited only by the creativity and resourcefulness of criminals. That's why spotting a BEC attempt early often comes down to noticing small inconsistencies rather than one obvious red flag. A few of the most common include:
Spoofed emails to HR professionals asking that an employee's direct deposit information be changed to an account controlled by a criminal.
Requests for personally identifiable information, such as an employee's Social Security number, employee ID, place or date of birth, or credit card and passport numbers, information that can later be used to impersonate the individual, access their accounts, or open credit in their name.
6 most common types of business email compromise
The first and most familiar form of BEC is CEO fraud: a business leader's email is hacked or spoofed, and fraudulent messages are sent in their name instructing subordinates to immediately wire payments to fraudulent accounts.
Accustomed to following instructions from senior leaders without question, subordinates often comply without independently confirming the request. While it's called CEO fraud, these attacks are just as often made in the name of a CFO or other senior finance executive.
Since then, BEC has morphed into multiple variants, including these six:
CEO Fraud: A spear phishing email attack where an attacker pretends to be a company's CEO to trick employees into transferring money to an account the attacker controls, or into divulging company or personal information.
CFO Fraud: Similar to CEO fraud, this involves an attacker posing as a company's CFO. This usually broadens the type of financial transaction the attacker can request, and can increase the plausibility of the request since it appears to come from the person who actually approves payments.
Personal email compromise (PEC): These attacks resemble CEO fraud but spoof an executive's personal email account instead. They can be even more convincing, since recipients may have received legitimate private emails from the executive before and assume the account is trustworthy.
Spoofed lawyer or real estate email accounts: A criminal impersonates one party to a sizable financial transaction, often real estate, but sometimes other commercial deals, and spoofs that party's email address. Messages typically include transaction details gleaned through social engineering or a prior account compromise, then instruct the recipient to change previously anticipated payment information, such as a wire destination or account number.
Requests for W-2 information: Instead of asking for cash, the attacker (posing as a senior employee) asks HR for an employee's W-2 data. That data can be used to file fraudulent tax returns and claim refunds, or to pursue other fraud that may not surface until the victim's credit is already damaged.
Gift card fraud: In this CEO-fraud variant, an attacker impersonates an executive and asks an assistant to purchase gift cards for "employee rewards," then requests the card serial numbers under time pressure, using those numbers to make fraudulent purchases before anyone notices.
Modern BEC attack methods
The core trick behind BEC, impersonating someone the recipient trusts, hasn't changed. What has changed is how convincingly, and how automatically, attackers can now pull it off.
AI-generated, automated invoice fraud
Attackers increasingly use large language models to write fluent, error free invoice and payment emails, then automate the rest of the operation. Mimecast's threat research team recently tracked a campaign that fabricates entire email threads, including a fake invoice, a forged "CEO approval," and an urgent follow up, using AI generated text and headless browser tools that assemble a matching PDF invoice moments before the email is sent.
An estimated 40% of BEC phishing emails now contain AI generated content, according to VIPRE's Q2 2024 Security Report, which makes tone and grammar far less reliable warning signs than they used to be.
Voice cloning and deepfake video
A few seconds of publicly available audio, such as an earnings call, conference talk, or LinkedIn video, is now enough to generate a convincing synthetic voice. Attackers pair cloned voices, or increasingly real time deepfake video, with a traditional spoofed email to fake the "verification" step employees are trained to rely on.
U.S. deepfake enabled fraud losses reportedly reached roughly $1.1 billion in 2025, up from about $360 million the year before. The Arup case below shows exactly how this plays out.
Vendor email compromise (VEC)
Rather than impersonating an executive, attackers compromise or convincingly spoof a real supplier, then quietly redirect an existing invoice or payment. Because the request rides on a legitimate business relationship and an active payment cycle, VEC is often harder for employees to question than a cold impersonation attempt. Third party involvement in breaches doubled in 2024, according to Verizon's 2025 Data Breach Investigations Report.
Quishing (QR code phishing)
Attackers embed a malicious QR code, often inside a PDF invoice or "secure document" attachment, that redirects a scanned phone to a credential harvesting page. Because most email security tools were built to scan text and links rather than images, quishing frequently slips past filters tuned for older phishing tactics.
Conversation hijacking
Instead of starting a new thread, attackers monitor an existing email conversation between a company and a partner, often after compromising one side's mailbox, then insert a fraudulent request, such as changed bank details or an "updated" invoice, at a moment when it looks like a natural continuation of a trusted exchange.
Each of these tactics is built to defeat one specific human habit: trusting a familiar voice, a familiar vendor, a familiar thread, or grammatically flawless writing. That's why filters alone can't fully solve BEC. Defense has to account for how people actually decide what to trust.
The global impact of BEC
BEC isn't concentrated in any one country, industry, or company size. The FBI's IC3 has logged BEC complaints from all 50 U.S. states and more than 180 countries, with fraudulent transfers landing in over 140 countries, often routed through intermediary banks in the UK, Hong Kong, China, Mexico, and the UAE before the trail goes cold.
Manufacturing, healthcare, real estate, government, and education are consistently among the most targeted sectors, largely because each involves frequent, large value payments and multi party approval chains attackers can exploit.
Why it's so hard to catch
Part of what makes BEC so hard to contain at a global scale is that it rarely leaves anything technical to catch. "It's how people are conversing, the type of communication they're having, that makes these messages malicious," says Edwin Moreno, Field CTO at Mimecast.
Because these attacks are typically payloadless, with no malicious link or attachment to scan, they can slip past defenses built to catch technical threats rather than conversational ones. Moreno points to just how little time defenders have to work with: on average, it takes about 60 seconds for someone to fall for one of these attacks once it reaches them.
The recovery window
That global reach is exactly why recovery is so time sensitive. The FBI's Financial Fraud Kill Chain, which can freeze a wire transfer if it's reported quickly enough, processed roughly 3,900 incidents involving $1.16 billion in attempted theft in 2025, recovering funds in 58% of cases. Once money clears international accounts, that recovery rate drops quickly.
Real-world BEC incidents
Statistics can make BEC feel abstract, a percentage, a billion-dollar figure. These three recent cases show exactly how the money moves, who gets fooled, and what determines whether it ever comes back.
Arup — $25.6 million lost to a deepfake video call (2024)
In January 2024, a finance employee at Arup's Hong Kong office joined what looked like a routine video call with the company's UK-based CFO and several colleagues. It began with a phishing email requesting a confidential transaction; the video call was meant to put the employee's doubts to rest. It worked.
Every person on that call, including the CFO, was an AI-generated deepfake built from public footage of real Arup executives. The employee authorized 15 transfers totaling roughly $25.6 million (HK$200 million) before the fraud was discovered.
City of Portland, Oregon — $6.75 million redirected through vendor impersonation (2025)
In February 2025, someone posing as an employee of a city contractor gained access to Portland's payment system and changed the contractor's bank account details. The city didn't catch the redirected payment until March, when the real contractor flagged a missing invoice. Because the fraud was reported quickly, the FBI was able to trace and seize the full $6,748,680 before it left the receiving account, a rare full recovery.
Massachusetts workers' union — $6.4 million lost to a spoofed investment manager (2023–2025)
A Dorchester, Massachusetts-based workers' union received a spoofed email from a scammer posing as its investment manager, instructing it to wire funds to a "corrected" account. The union transferred $6.4 million before realizing the message was fraudulent. Investigators traced the funds through several intermediary accounts, including transfers toward a cryptocurrency exchange and banks in Hong Kong, China, Singapore, and Nigeria, before the Department of Justice secured forfeiture of roughly $5.3 million of the traceable proceeds.
What these cases have in common:
Video and voice aren't proof of identity anymore. Arup shows that seeing and hearing "colleagues" on a call is no longer a reliable verification step on its own.
The safest-looking request is often the most dangerous. Both the Portland and union cases involved changes that moved through completely normal payment channels, nothing about the request itself looked unusual.
Speed determines whether the money comes back. Portland's near-total recovery happened because the fraud was reported within weeks. The FBI recommends reporting any suspected fraudulent transfer within 72 hours, while there's still a chance to freeze it.
No organization is "too small" or "too unusual" a target. An engineering firm, a city government, and a labor union were all hit within about two years of each other.
How to protect against business email compromise
Preventing business email compromise takes more than one control or one training session. The tactics above are specifically designed to slip past any single layer of defense. Organizations that handle this well combine three things: technical controls that catch fraudulent messages before employees see them, process controls that make it harder for money to move on a single unverified request, and awareness training that helps people recognize subtler signs of impersonation.
Technical controls
Technology is the first line of defense. It needs to catch fraudulent messages before an employee ever has to make a judgment call. The tools below work best layered together, since each one closes a gap the others miss.
Email authentication (SPF, DKIM, DMARC) to verify sender legitimacy and block spoofed incoming emails before delivery. DMARC adoption climbed from 43% to 54% of senders in 2024, meaningful progress, but still leaving more than four in ten organizations exposed to the domain-spoofing tactics DMARC is built to stop.
AI-driven filtering and behavioral analysis to catch anomalies in sender behavior, writing style, and payment requests that rules-based filters miss.
Multifactor authentication (MFA) across email and financial systems, to limit the damage if credentials are compromised.
User and entity behavior analytics (UEBA) to flag unusual login locations, timing, or access patterns.
Process controls
Even the best filters miss messages that carry no technical red flags at all, no malware, no spoofed domain, just a convincing, well-timed request. Process controls create a second checkpoint that doesn't depend on spotting anything suspicious in the message itself.
Any request to change bank details or move funds should require a second, out-of-band confirmation, a phone call to a known number, not one supplied in the email, and wire transfers above a defined amount should carry a mandatory dual-approval threshold. Vendor onboarding and payment-change requests should follow a standardized process that doesn't rely on email alone, so that a single message can never be enough to redirect funds on its own.
Organizations should also have an incident response plan specifically for suspected BEC, with a clear instruction to report suspected fraud to your bank and to IC3.gov within 72 hours. The window that made the difference in Portland's recovery above.
Awareness and training
Technology and process controls only work if people actually follow them, especially when a request feels urgent. Training needs to target the roles attackers target most, and reward the instinct to double-check rather than punish it.
Train finance, HR, and executive-support staff, the roles BEC targets most, to question unusual urgency, requests to bypass normal channels, or instructions to keep a transaction confidential.
Run realistic phishing and BEC simulations that include voice or video scenarios, not just email.
Build a reporting culture where flagging a suspicious message is treated as good judgment, not a nuisance. Close to half of employees say they hesitate to report a security mistake for fear of consequences, a hesitation that costs organizations valuable response time.
No single layer here is sufficient on its own. Authentication protocols stop spoofed domains but not compromised accounts. AI detection catches behavioral anomalies but can miss a well-timed phone call. Verification processes only work if people actually follow them under pressure. That's the real challenge of defending against BEC: it's engineered to find whichever layer is weakest.
Stop business email compromise with Mimecast
Business email compromise succeeds because it doesn't need to break anything. It just needs someone to believe a message, a voice, or a video is real. That's what makes it different from most cybercrime, and why it remains one of the costliest: the FBI tracked $3.05 billion in reported U.S. losses in 2025 alone, and the tactics keep evolving faster than most training programs do.
The organizations that hold up best against BEC aren't necessarily the ones with the most tools. They're the ones that treat verification as a habit rather than an inconvenience, and that build defenses around how people actually communicate and decide what to trust. Combining email authentication, AI-driven detection, and process controls like out-of-band verification closes most of the gaps BEC is built to exploit, but only if it's backed by a culture where double-checking an unusual request is normal, not awkward.
If you're evaluating how your organization's email security stacks up against modern BEC tactics, Mimecast's Advanced BEC Protection is one option worth a look.
Business email compromise is when an attacker obtains access to an email account to send and receive emails fraudulently. They’re pretending to be the email account’s owner.
Ready to get started?
See how Mimecast protects your people, AI, and data in a single platform.
