Business email compromise (BEC)

Business email compromise (BEC) is fraud that uses a hijacked or convincingly faked business email account to send a payment somewhere it shouldn’t go. Usually there’s no malware and no hacked software. Somebody just changes who gets paid, and the normal finance process does the rest.

That’s what makes it so expensive. This library has 37 BEC cases, including several where a single incident ran to tens of millions of dollars, and one where Google and Facebook were taken for more than $120 million.

How a BEC attack works

1. Pick a target. A company that sends big payments, and a person who can send them.
2. Get an email identity. Either break into a real mailbox, or set up a convincing fake.
3. Watch and learn. With a real mailbox, the attacker reads actual invoices, suppliers and payment dates first.
4. Make the ask. New bank details, or an urgent transfer, framed as routine or confidential.
5. Add pressure. A deadline, a senior name, a request for secrecy.
6. Cash out. Money moves, often split into several transfers so it’s harder to claw back.

BEC examples from this library

Regulators have noticed. In 2018 the SEC published a report on nine public companies that lost nearly $100 million between them to fake-executive and fake-vendor emails, and used it to warn about internal accounting controls. Full case: SEC report on nine issuers. And in 2025 a federal grand jury in South Carolina indicted 12 people over an alleged nationwide BEC ring. Full case: South Carolina BEC ring.

The secret deal trick

Three of the big ones above run on the same script. At Scoular, impostors posing as the CEO and someone from the audit firm told the controller about a secret acquisition in China; he sent $17.2 million to Shanghai. At Tecnimont, the head of the Indian subsidiary sat through staged conference calls with a fake CEO and a fictitious Swiss lawyer, then wired $18.6 million. At Ubiquiti, the fake CEO had a fake law firm partner backing him up.

In each, the request for secrecy is what kept the usual checks from happening. Full cases: Scoular, Tecnimont, Ubiquiti.

Tip: “keep this confidential” plus “it has to go today” is the BEC signature. Either one alone deserves a phone call. Both together, always.

How it compares with CEO fraud, invoice fraud and phishing

CEO fraud is BEC where the disguise is a senior executive. Invoice fraud redirects a payment you were already expecting to make. W-2 phishing borrows the fake-boss routine but goes after payroll’s tax forms, not cash. And ordinary phishing? Wider net, usually fishing for a password or a malware install rather than one fat wire.

How to stop BEC

• Call back on a number you already had before changing bank details or sending anything unusual.
• Over a set amount, two people sign. The CEO’s name on the request changes nothing.
• “Confidential” means escalate. Never a reason to cut corners.
• Put a ceiling on single transfers so nobody can drip $17 million out in three chunks, Scoular-style.
• Handle supplier bank changes as a controlled process, never as an email request.

Mattel shows the other side. In 2015 it sent $3 million on a forged email from its brand-new CEO, spotted it fast, and got the money back. Full case: Mattel recovered wire.

Business email compromise: common questions

Reviewed by the SEE Team on 22 October 2026; every case linked here has its sources on its own page. See the methodology and about SEE.