Business Email Compromise: the costliest scam

Not every costliest attack looks spectacular. Business Email Compromise (BEC) is a scam with no malware and no encryption — just an email that convinces someone in the company to make a transfer to a criminal’s account. It’s one of the most expensive categories of fraud for businesses, because it targets processes and trust, not technology.

The two most common variants

The “urgent CEO transfer”. A finance employee receives a message supposedly from the board: “I’m in a meeting, I urgently need a transfer done, it’s confidential.” Pressure, authority and secrecy switch off the usual verification.

Invoice fraud. The criminal impersonates a regular supplier and reports a “change of bank account number”. The next invoice is paid — into the fraudster’s account. This variant is often preceded by a mailbox takeover, which we cover in our piece on KSeF and gov.pl phishing.

Why it works

Authority and haste. A request “from the CEO” with time pressure discourages questions.
Realism. With a compromised mailbox, the attacker knows the context — names, tone, the history of the correspondence, payment deadlines.
A process gap. If changing an account number doesn’t require independent confirmation, one email is enough to redirect the money.

How to defend — process before technology

BEC is defused mainly by procedure, not a tool:

Second-channel verification. Confirm every account-number change and every unusual transfer by phone — on a previously known number, not from the email.
A four-eyes rule for payments above a threshold.
A clear “stop and check” path — an employee must have the right to hold an “urgent” transfer without fear of a manager’s reaction.

The technical layer that helps

SPF, DKIM and DMARC make it harder to impersonate your domain.
Flagging emails from outside the organisation and detecting look-alike domains (typosquatting).
MFA on mailboxes — a compromised inbox is fuel for BEC.

The key takeaway: with BEC, the payment procedure is the security system. A company that verifies account changes through a second channel is resilient even to a very convincing email. If you’d like to test the resilience of your processes, get in touch.

BEC does not require mailbox compromise

The FBI defines BEC as transfer fraud performed through social engineering or intrusion into communication channels. An attacker may control a real mailbox, register a look-alike domain or impersonate someone through another channel. SPF, DKIM and DMARC reduce direct domain spoofing but cannot stop mail from a contractor’s genuinely compromised account.

Safe payment-detail changes

Every bank-account, recipient or payment-method change should trigger fresh verification. Call a number previously stored in the contract or supplier system, never one supplied in the suspicious message. Record the result and approver in the finance system. High-value payments need independent second approval.

An exception because “the CEO asked” is exactly what the attacker wants. Procedure must cover executives and allow staff to pause a transfer without penalty.

Response after money is sent

Do not wait for a complete investigation. Contact the bank immediately to stop or recover the transfer, notify the relevant authorities and preserve messages with headers. Remove malicious forwarding rules, revoke sessions, reset credentials and review sign-ins and OAuth applications.

Determine which conversations and invoices the attacker saw. BEC often enters an existing thread, so verify other pending payments and notify suppliers through trusted channels.

Testing the process

An exercise should cover message recognition, payment hold, second-channel contact, escalation and bank-response speed. A click-rate phishing simulation alone does not test the most important financial control.

Sources: FBI IC3 — Business Email Compromise, FBI IC3 — 2025 Annual Report.