What Business email compromise (BEC) means
BEC often looks like a vendor changing bank details or an executive urgently requesting a wire. It causes some of the largest financial losses of any cybercrime. MFA, DMARC and a rule to verify payment changes by phone are strong defenses.
Why it matters for your website
One convincing fake email asking to change bank details can send a large payment to criminals, and that money is often hard or impossible to recover. Small businesses are frequent targets because they have fewer checks in place. Simple verification habits and email security settings go a long way.
Example
A bookkeeper gets an email that looks like it is from a regular supplier, asking to update payment details. She calls the supplier using a phone number already on file and learns the email was fake.
Tips
- Verify any payment or banking change by phone using a known number.
- Set up SPF, DKIM and DMARC records for your email domain.
- Turn on two-factor authentication for every email account.
Common mistakes
- Trusting an urgent email just because it shows a familiar name.
- Calling the phone number listed inside a suspicious email to verify it.
Questions about Business email compromise (BEC)
What is Business email compromise (BEC)?
A scam where criminals impersonate or take over a business email account to redirect payments or steal data.
How can I tell if an email is a BEC scam?
Watch for urgency, secrecy, new payment instructions and small changes in the sender's address. When in doubt, confirm through a separate channel you already trust.
What should I do if we sent money to a scammer?
Contact your bank right away to try to stop or recall the transfer. In the US, also report it to the FBI's Internet Crime Complaint Center (IC3) and secure the affected email accounts.
