Business email compromise (BEC) is a targeted fraud where attackers impersonate executives, vendors, or colleagues to trick employees into wiring money or surrendering sensitive data. The FBI's IC3 recorded verified BEC losses in 2025 totaling over three billion dollars from nearly twenty-five thousand complaints, with an average loss per incident of about $123,000. If you're responsible for protecting your organization, three controls reduce your exposure right now:
- Enforce voice verification for any payment or vendor-bank change. Call the requester at a number already on file, not one provided in the email. A two-minute call bypasses the deceptive email channel entirely and stops the majority of BEC attempts cold.
- Require multi-factor authentication (MFA) on every email account. Account takeover is the entry point for the most damaging BEC variants; MFA blocks the credential-stuffing and phishing attacks that enable it.
- Temporarily raise dual-approval thresholds. Until controls are fully deployed, require two separate approvers for any wire or ACH above your current single-approver limit. Dual authorization removes the single point of failure that most BEC campaigns exploit.
These three steps address the mechanics of how BEC actually succeeds: attackers rely on one person with authority, one email channel, and urgency. Break any one of those three conditions and the fraud fails.
Table of Contents
- What does business email compromise actually look like?
- How does a BEC attack unfold from start to finish?
- What are the red flags that signal a probable BEC attempt?
- Which technical controls actually reduce BEC risk?
- What operational policies stop BEC when email is already compromised?
- What should you monitor to catch BEC attempts early?
- What do you do in the first 72 hours after a BEC incident?
- How big is the BEC problem, and where is it heading?
- Your BEC prevention and response checklist
- How Collett Systems LLC helps SMBs prevent and recover from BEC
- Legal implications and regulatory compliance after a BEC incident
- What cyber insurance covers for BEC losses, and what it doesn't
- Key Takeaways
- Why operational enforcement beats awareness training alone
- Collett Systems LLC: managed security built for SMBs facing BEC threats
- Authoritative sources and further reading
What does business email compromise actually look like?
BEC is distinct from broad phishing because it is targeted and research-driven. Attackers study your organization before sending a single email. They review LinkedIn for org-chart details, scan public filings for vendor relationships, and monitor social media for travel schedules. The result is a message that looks credible to the specific person receiving it, not a mass-blast hoping for a click.
Small businesses are disproportionately targeted because lean accounting teams often mean one person can both initiate and approve a wire transfer. That single point of failure is exactly what attackers map before they send the first email.
CEO/executive impersonation (whaling)
The attacker spoofs or compromises the CEO's email and sends an urgent wire request to the CFO or a finance staff member. The message typically invokes confidentiality ("don't discuss this with anyone") and a tight deadline. In an SMB context, this plays out as a Friday-afternoon email from the owner asking accounts payable to process a vendor payment before the weekend.
Vendor invoice modification
The attacker intercepts or spoofs a legitimate vendor's email and sends a modified invoice with updated banking details. The finance team pays the invoice, believing it is routine. By the time the real vendor follows up on the unpaid balance, the funds are typically unrecoverable.
Account takeover (EAC)
Email account compromise goes a step further: the attacker actually logs into a legitimate email account, monitors conversations for payment threads, and then injects fraudulent instructions at exactly the right moment. The email comes from a real address with a real history, making it the hardest variant to catch without technical controls.
Real-estate and escrow fraud
Buyers receive wire instructions for closing costs from what appears to be their title company or attorney. The funds go to an attacker-controlled account. Losses in this category can reach six figures in a single transaction.
Pro Tip: Finance, accounts payable, HR (for W-2 and direct-deposit changes), and C-suite executives are the four roles most frequently targeted. Map your payment workflows to these roles and apply your tightest controls there first.
How does a BEC attack unfold from start to finish?
Understanding the attack sequence helps you place controls at the right stage rather than reacting after funds have moved.
- Reconnaissance. Attackers gather publicly available information: LinkedIn profiles, company websites, press releases, court filings, and social media. They identify who approves payments, who the key vendors are, and when executives travel.
- Compromise or impersonation. The attacker either registers a lookalike domain (e.g., "acme-corp.com" vs. "acmecorp.com"), spoofs the display name, or steals credentials to take over a real account. Credential theft typically comes from a prior phishing email or a credential-stuffing attack against a reused password.
- Delivery of the fraudulent request. The attacker sends the request from the impersonated or compromised account, usually invoking urgency, secrecy, or an authority figure. The message arrives in a normal-looking email thread, sometimes with prior legitimate messages quoted below it.
- Execution. The target initiates a wire transfer, ACH payment, or gift-card purchase. The majority of BEC losses move via wire transfer or ACH, which is why banking notification speed matters so much.
- Cash-out and cleanup. Funds move through one or more intermediary accounts, often overseas, within hours. The attacker may also delete sent items, set up forwarding rules to hide follow-up emails, and cover tracks before the victim realizes what happened.
Funds can leave your bank account very quickly after the fraudulent request is sent. Recovery depends almost entirely on how quickly you notify your bank and file with the FBI's IC3.
Generative AI is changing the threat profile. AI tools now enable attackers to generate convincing phishing content and synthesize executive voices for vishing calls. A voice call from what sounds like your CEO is no longer a reliable verification method. The implication: verification must be process-based, not perception-based. Call back on a number you already have on file, or use a pre-established code word for high-value transactions.
What are the red flags that signal a probable BEC attempt?
Social-engineering signals to watch for
- Urgency and secrecy: "Process this before end of day" combined with "don't mention this to anyone" is the most common BEC pattern.
- Off-hours requests: Requests arriving Friday afternoon, before a holiday, or while a key approver is traveling are timed deliberately.
- Unusual vendor instructions: Any mid-transaction request to change banking details, especially via email alone, should trigger an out-of-band call.
- Domain lookalikes: Watch for subtle substitutions: "rn" for "m," added hyphens, or a different TLD (.net instead of.com).
Technical checks any IT team can run
Examine the sender envelope address (the actual "From:" header) versus the display name shown in the email client. A display name reading "CEO Name" with an envelope address from a free webmail domain is a clear impersonation signal.
Check SPF, DKIM, and DMARC results in the email headers. A message that fails DMARC alignment from a domain that has a published DMARC policy is a strong indicator of spoofing. Also audit mailbox rules regularly: attackers who gain access often create forwarding rules or "delete on arrival" rules to hide their activity.
Which technical controls actually reduce BEC risk?
Microsoft's security guidance frames BEC defense as a combination of technical controls, process enforcement, and continuous monitoring. No single tool closes the gap alone.
MFA: priority order matters
Not all MFA is equal. Phishing-resistant methods stop credential-theft attacks that enable account takeover; SMS-based codes do not. Implement in this order:
- Passkeys: device-bound credentials that cannot be phished; learn more about phishing-resistant MFA options and why they matter for email security
- Authenticator app TOTP, (e.g., Microsoft Authenticator, Google Authenticator): strong, widely deployable
Pro Tip: Prioritize MFA on email accounts, financial systems, and VPN access first. Those three surfaces cover the majority of BEC entry points. Read why MFA matters for your business before your next IT planning session.
Email authentication: SPF, DKIM, and DMARC
SPF tells receiving mail servers which IP addresses are authorized to send email for your domain. DKIM adds a cryptographic signature that verifies the message was not altered in transit. DMARC ties them together and tells receivers what to do with mail that fails alignment: monitor, quarantine, or reject. A DMARC policy at "reject" prevents spoofed emails from reaching your employees' inboxes at all. Review why email trust metrics matter for a practical walkthrough of setting these records correctly.
Secure mail gateways and endpoint protection
A secure email gateway with link inspection and attachment sandboxing catches malicious payloads before they reach the inbox. Endpoint detection and response (EDR) tools provide visibility into unusual login behavior and lateral movement after a credential is compromised. Together, they close the gap between a compromised credential and a completed fraud.
| Control | Priority | Primary BEC Risk It Addresses |
|---|---|---|
| Phishing-resistant MFA | High | Account takeover (EAC) |
| DMARC at reject | High | Domain spoofing, display-name fraud |
| Secure email gateway | High | Malicious links, payload delivery |
| EDR / endpoint visibility | Medium | Post-compromise lateral movement |
| SIEM log correlation | Medium | Anomaly detection, forwarding rules |
| Security awareness training | Ongoing | Social-engineering susceptibility |
What operational policies stop BEC when email is already compromised?
Technical controls are necessary, but they are not sufficient. Organizations consistently have the tools and information they need yet fail to enforce simple financial controls like dual authorization and mandatory verification. Policy enforcement is where most SMBs lose.
Core policy checklist
- Mandatory voice verification for any payment change or vendor-bank update, using a number already on file, not one provided in the request
- Dual approval for all wire transfers and ACH payments above defined thresholds, with two separate individuals required (not the same person approving their own request)
- No urgency exceptions: a policy that explicitly states "urgency from an executive does not override verification" removes the social-engineering lever attackers rely on most
- Written vendor-change policy: any banking-detail change from a vendor requires a signed form and a callback to a verified contact before the change takes effect
- Periodic vendor-list audits: confirm active vendor relationships and banking details quarterly, not just when a change is requested
Sample dual-approval matrix
| Transfer Amount | Initiator | First Approver | Second Approver |
|---|---|---|---|
| , | AP Staff | AP Manager | , |
| , | AP Staff | AP Manager | Controller |
| $25,000, $100,000 | Controller | CFO | CEO |
| Over $100,000 | CFO | CEO | Board member or designated officer |
Operational controls remove the single point of failure. Requiring two separate approvers for transfers above defined thresholds forces attackers to manipulate two people simultaneously, which is exponentially harder and defeats the majority of BEC schemes that depend on one person acting alone under pressure.
What should you monitor to catch BEC attempts early?
Detecting account takeover requires attention to non-content signals: new mailbox forwarding rules, changed reply-to addresses, concurrent logins from unusual geographies, and immediate outbound wire requests. These signals should feed a SOAR playbook for rapid containment.
Monitoring checklist
- Anomalous login locations: logins from countries or cities where the user has no travel history
- New forwarding rules: any rule that forwards email to an external address, especially if created recently
- Mailbox rule changes: rules that delete, move, or mark as read messages containing keywords like "invoice," "wire," or "payment"
- Mass BCC activity: unusual outbound volume to external recipients from finance or executive mailboxes
- Spikes in external email to finance groups: a sudden increase in inbound email to AP or treasury from external domains
Example SIEM correlation rules
A high-value alert: login from a new country for a finance-role user, followed by an outbound wire request or vendor-banking-change email within four hours. Route this to immediate analyst review, not a next-business-day queue.
A second useful rule: creation of a new mailbox forwarding rule by any user in the finance, HR, or executive group, triggering an automatic notification to the security team. Real emails from compromised accounts can still be phishing, and mailbox-rule abuse is the most common way attackers sustain access invisibly.
Log retention guidance: preserve full email headers, message bodies, authentication logs (SPF/DKIM/DMARC results), and bank transaction records for a minimum of 90 days. Law enforcement and your cyber insurer will need this data for investigation and recovery.
What do you do in the first 72 hours after a BEC incident?
Speed is the controlling variable in BEC recovery. The FBI's Recovery Asset Team can act only within short time windows, and funds that have moved to overseas accounts are rarely recovered. Every hour of delay reduces the probability of getting money back.
Incident response checklist
- File an IC3 complaint at ic3.gov, Include all wire details, email headers, and a timeline. The IC3 feeds the FBI's Financial Fraud Kill Chain process, which coordinates with destination banks to freeze funds.
What to include in your bank and IC3 notifications
- Originating account number and institution
- Destination account number, routing number, and receiving bank name
- Exact dollar amount and transaction timestamp
- Full email headers from the fraudulent request
- Any phone numbers or names used by the attacker
- A brief timeline from first contact to fund transfer
How big is the BEC problem, and where is it heading?
The scale is not abstract. The FBI's IC3 2025 Annual Report places BEC second only to investment fraud in total reported losses across all cybercrime categories. With $3,046,598,558 in verified losses from 24,768 complaints, the average incident is about $123,000, far from minor.
| IC3 Metric | 2025 Figure |
|---|---|
| Total verified BEC losses | $3,046,598,558 |
| Number of BEC complaints | 24,768 |
| Average loss per complaint | $123,000 |
| Share of losses via wire/ACH | 86% |
The $3 billion figure covers only reported and verified losses. Unreported incidents, losses attributed to related fraud categories, and cases where victims did not connect the fraud to BEC mean the true number is almost certainly higher.
The AI escalation is real and accelerating. Generative AI tools are lowering the technical threshold for attackers, enabling realistic executive voice synthesis for vishing and near-perfect written impersonation at scale. The practical implication for your organization: training employees to "spot the typo" is no longer a viable primary defense. Process verification must replace perception-based judgment.
Year-over-year, BEC losses have grown even as awareness has increased. The gap is not informational. Organizations know BEC exists. The gap is operational: policies that exist on paper but are not enforced at the transaction level.
Your BEC prevention and response checklist
This week
- Enforce voice verification for all payment and vendor-bank changes
- Enable MFA on all email accounts, prioritizing finance, HR, and executive roles
- Audit mailbox forwarding rules and remove any unauthorized rules immediately
- Confirm your bank's fraud hotline number and save it in your incident-response contacts
- Brief your AP and finance team on the dual-approval policy
Next 90 days
- Deploy DMARC at quarantine, then move to reject once monitoring confirms no legitimate mail is failing
- Implement the dual-approval matrix above for all wire and ACH transfers
- Run a tabletop exercise simulating a CEO-fraud scenario with your finance and IT teams
- Set up SIEM alerts for anomalous logins and new forwarding rules in finance/executive mailboxes
- Review cyber insurance coverage and confirm BEC losses are explicitly covered
- Establish a written vendor-banking-change policy and distribute it to all AP staff
Ongoing
- Monthly review of mailbox rules and login anomaly reports
- Quarterly vendor-list audits to confirm active relationships and banking details
- Annual BEC-specific security awareness training for finance, HR, and executive staff
- Post-incident reviews after any suspicious email or near-miss to update controls
Notification template snippets
Bank fraud notification (call first, then follow up in writing): "We believe a fraudulent wire transfer was initiated from our account [account number] on [date] at approximately [time]. The destination account is [routing/account number] at [receiving bank]. We request an immediate recall and freeze. Our contact is [name, phone, email]."
IC3 report essentials: File at ic3.gov. Include victim name, contact information, financial institution details, transaction amounts and dates, full email headers, and a narrative timeline. The more detail you provide, the faster the Financial Fraud Kill Chain can act.
Curated resources
- FBI IC3 2025 Annual Report, authoritative loss statistics and complaint data
- FBI BEC resource page, definitions, examples, and reporting guidance
- CISA BEC guidance, technical advisories and sector-specific resources
- Microsoft BEC security guidance, technical controls and detection recommendations
- Collett Systems: catching BEC attacks in progress, human factors and detection practices for SMBs
How Collett Systems LLC helps SMBs prevent and recover from BEC
Small businesses are disproportionately targeted because lean teams create the single points of failure attackers need. Collett Systems LLC works with over 150 organizations across Southeastern Wisconsin to close exactly those gaps, with a fully managed stack that covers the controls in this guide.
Services directly relevant to BEC prevention and response include:
- Endpoint detection and response (EDR):, visibility into post-compromise activity and lateral movement
Collett Systems LLC serves manufacturers, financial firms, and professional services companies across West Bend and Southeastern Wisconsin. Our cybersecurity solutions are built for organizations that treat security as infrastructure, not an afterthought.
Legal implications and regulatory compliance after a BEC incident
A successful BEC attack is not just a financial loss. Depending on your industry and the data exposed, it can trigger regulatory notification obligations, contractual liability, and civil litigation.
Data breach notification laws: If the attacker accessed email accounts containing personally identifiable information (PII), protected health information (PHI), or financial account data, most U.S. states require notification to affected individuals within defined timeframes. Wisconsin's data breach notification law, for example, requires notification to affected Wisconsin residents without unreasonable delay. Federal sector-specific rules, including HIPAA for healthcare and GLBA for financial services, impose additional requirements.
Regulatory exposure: Organizations subject to SEC rules, FINRA oversight, or state financial regulations may face examination scrutiny if BEC losses indicate deficient internal controls. The SEC has brought enforcement actions against public companies for inadequate cybersecurity controls that enabled fraud.
Contractual liability: Vendor agreements and client contracts often include security obligations. A BEC incident that exposes vendor or client data can trigger breach-of-contract claims, particularly if the organization failed to implement controls that were contractually required.
Practical steps: Document your security controls before an incident, not after. Maintain written policies, training records, and configuration documentation. If an incident occurs, engage legal counsel early, particularly before making public statements or communicating with regulators. Preserve all evidence in its original form and avoid remediation steps that overwrite forensic data before it is captured.
This section is general information, not legal advice. Confirm your specific notification obligations and regulatory requirements with qualified legal counsel and your relevant regulatory bodies.
What cyber insurance covers for BEC losses, and what it doesn't
Cyber insurance is a legitimate part of a BEC risk management strategy, but the coverage landscape has tightened significantly as losses have grown.
What most policies cover: First-party cyber policies typically cover direct financial losses from funds-transfer fraud, forensic investigation costs, legal fees, notification expenses, and business interruption. Some policies include social-engineering fraud coverage specifically for BEC-type losses.
What many policies exclude: Social-engineering fraud coverage is often a sublimit or a separate endorsement, not a default inclusion. Read your policy carefully. Some insurers exclude losses where the organization failed to follow its own stated security procedures, which is directly relevant if you have a dual-authorization policy that was bypassed.
Underwriting requirements are tightening: Insurers now routinely require MFA on email and financial systems, DMARC deployment, and documented incident-response plans as conditions of coverage. Failing to maintain these controls can void a claim. Before your next renewal, confirm that your actual security posture matches what your application stated.
Practical guidance: Work with a broker who specializes in cyber coverage, not a generalist. Ask specifically about social-engineering fraud sublimits, the definition of "authorized" versus "unauthorized" transfers (some policies deny claims where an employee voluntarily initiated the transfer, even under deception), and the notification timeframe required after discovery. Also confirm that your policy covers losses from vendor email compromise, not just direct impersonation of your own executives.
For organizations in financial services, healthcare, or other regulated industries, coordinate your insurance coverage review with your compliance and legal teams. Coverage gaps in one area can create unexpected exposure in another.
Key Takeaways
Business email compromise succeeds because organizations fail to enforce the financial controls they already know they need, not because attackers are technically unstoppable.
| Point | Details |
|---|---|
| Voice verification stops most BEC | A call to a verified number on file defeats the majority of BEC attempts by bypassing the email channel. |
| $3B+ in verified 2025 losses | The FBI's IC3 recorded over three billion dollars in BEC losses from nearly twenty-five thousand complaints, averaging in the six-figure range per incident. |
| Dual authorization is the policy anchor | Requiring two separate approvers for transfers above defined thresholds removes the single point of failure BEC exploits. |
| 72-hour window controls recovery | Notifying your bank and filing an IC3 complaint within 72 hours gives the FBI's Recovery Asset Team its best chance to freeze funds. |
| Collett Systems LLC closes the gap | Collett Systems LLC provides managed MFA rollout, email authentication, 24/7 monitoring, and incident response for 150+ SMBs in Southeastern Wisconsin. |
Why operational enforcement beats awareness training alone
Most organizations that get hit by BEC aren't naive. Their employees have sat through security awareness training. They've seen the posters. They know what phishing looks like, at least in theory. The problem is that awareness doesn't hold up under pressure. When the CEO emails at 4:45 PM on a Friday asking for an urgent wire, the employee's training competes with their fear of looking unresponsive to leadership. Training loses that contest more often than security teams want to admit.
The controls that actually work are the ones that remove the decision entirely. A policy that says "no payment change is processed without a callback to a verified number, regardless of who is asking" doesn't require the employee to make a judgment call under pressure. It gives them a script. It gives them cover. And it makes the attacker's job structurally harder, not just marginally harder.
The AI escalation makes this more urgent, not less. When a synthesized voice call from what sounds exactly like your CFO is a realistic attack vector, "trust your instincts" is not a defense. Process is the defense. Verification is the defense. The tabletop exercise I'd recommend running this quarter is simple: simulate a CEO-fraud wire request arriving Friday afternoon while the CFO is traveling. Walk your finance team through the exact steps they should take. Time it. Find the gaps. Fix the policy before an attacker finds the gap for you.
A 60-minute tabletop agenda that works: 15 minutes reviewing your current payment-approval policy, 20 minutes walking through the simulated scenario with your AP and finance team, 15 minutes identifying where the process broke down or where someone would have been tempted to bypass verification, and 10 minutes assigning specific policy updates with owners and deadlines. That one hour of structured practice is worth more than a year of awareness training videos.
Collett Systems LLC: managed security built for SMBs facing BEC threats
The controls in this guide are well-documented. The challenge for most small and mid-sized businesses in Southeastern Wisconsin isn't knowing what to do. It's having the staff, the tools, and the enforced processes to do it consistently. That's the gap Collett Systems LLC fills.
We deploy and manage the full BEC prevention stack for our clients: phishing-resistant MFA, DMARC at reject, secure email gateways, EDR, SIEM alerting for anomalous login and forwarding-rule activity, and documented dual-authorization policies. When an incident happens, we're the team that helps you contain it, preserve evidence, notify your bank, and coordinate with law enforcement. No scrambling to find a vendor at 5 PM on a Friday.
Over 150 organizations across West Bend and Southeastern Wisconsin trust Collett Systems LLC with their security infrastructure. Our fixed per-user pricing means you know exactly what you're paying, and our 24/7 monitoring means threats don't wait for business hours. Start with a paid IT & Security Assessment to get a clear picture of your current exposure and a prioritized remediation plan, or explore our full managed IT services to see how we build and maintain the stack for you.
Authoritative sources and further reading
- FBI IC3 2025 Annual Report, the primary source for U.S. BEC loss statistics, complaint volumes, and trend data; download directly from the FBI
- FBI BEC resource page, definitions, variant descriptions, and direct links to file an IC3 complaint
- IC3 complaint filing portal, file your BEC complaint here; include full wire details and email headers for the Financial Fraud Kill Chain to act
- CISA cybersecurity guidance, technical advisories, sector-specific resources, and incident reporting for critical infrastructure organizations
- Microsoft BEC security guidance, technical controls, detection recommendations, and product-specific configuration guidance
- FTC cybersecurity for small business, email authentication setup guidance and practical SMB security resources from the Federal Trade Commission
- U.S. Secret Service BEC overview, investigative perspective and reporting guidance from the Secret Service's financial crimes division
- SmishAlert threat intelligence, live campaign examples covering AI-driven SMS and voice-based impersonation tactics that increasingly accompany BEC attempts
- Collett Systems: email trust metrics, practical walkthrough of SPF, DKIM, and DMARC configuration for SMBs
When to file with IC3: File immediately upon discovery, even if you are still gathering details. An incomplete report filed quickly is more useful to the FBI's Recovery Asset Team than a complete report filed three days later. You can update your complaint with additional information after the initial filing. Collect wire details (amount, destination account, routing number, receiving bank), full email headers, and a timeline before you call your bank and before you file.
Check your domain's email trust score
Free 60-second tool, see how your SPF, DKIM, and DMARC look to recipients.