Guide
What is business email compromise?
How the attack actually runs
Reconnaissance. Public filings, social media, out-of-office replies and leaked databases tell the attacker who signs off payments, who to impersonate, and when people are away.
Access or impersonation. Either a real mailbox is taken over — through a phished password, a stolen session token, or a password reused elsewhere — or a lookalike domain is registered to imitate one.
The request. A payment to new bank details, an urgent transfer, a change to payroll, a “confidential” document, a request to send credentials. It is timed for when the person who would normally object is unavailable.
The cash-out. Funds are moved quickly through intermediary accounts. Recovery rates are low and fall with every hour that passes.
The numbers
The FBI's Internet Crime Complaint Center logged 24,768 business email compromise complaints in 2025, with reported losses of $3.05 billion — the largest single category by loss in the report. Phishing and spoofing, the delivery method for much of it, accounted for a further 191,561 complaints.
Reported losses only count what people chose to report. The true figure is higher.
Why normal email filtering misses it
Most BEC has nothing for a filter to catch. There is no malicious attachment and no link to a hacking site. Often the mail genuinely comes from a real account, because the account was compromised rather than imitated. The signature, the history and the tone are all correct.
That is the design. Antivirus and spam tools look for bad content; BEC is good content asking for something bad.
The common forms
Invoice and payment redirection: the supplier's bank details change.
CEO fraud: a director urgently needs a transfer, and cannot talk right now.
Thread hijacking: a real conversation is taken over and the request is slipped in mid-thread.
Payroll diversion: an employee's salary account quietly changes.
Data and credential requests: tax forms, client lists, logins.
What actually reduces it
A callback rule. Any change of bank details is confirmed by phone on a number already held, by someone other than the person requesting it.
Two people on payments. A second pair of eyes on anything over an agreed amount, with no exceptions for seniority or urgency.
Multi-factor authentication on every mailbox, phishing-resistant where possible, and DMARC enforcement on your own domain so it cannot be spoofed.
A route to report suspicion without blame. Most losses grow because someone was embarrassed to say they had already paid.
Technology helps at the edges. The controls that stop BEC are procedural, and they work because they do not depend on anyone being alert at the right moment.
Questions
Is business email compromise the same as phishing?
Phishing is the delivery method; business email compromise is the fraud. A BEC attempt may use phishing to take over a mailbox, or may simply impersonate someone using a lookalike domain. Not all BEC involves phishing, and not all phishing is BEC.
Can antivirus or an email filter stop business email compromise?
Rarely on its own. Much BEC contains no malware and no malicious link, and often comes from a genuine account. Filters reduce volume but the reliable controls are procedural: callbacks on payment changes, dual authorisation, and MFA on mailboxes.
How much money does business email compromise cost?
The FBI's IC3 recorded $3.05 billion in reported losses from 24,768 business email compromise complaints in 2025. Reported losses understate the real total, since many incidents are never reported.
Check a message before you act
If you have a message in front of you and you are not sure, paste it into Globosafe. You get a verdict — genuine, suspicious or fraudulent — with the specific warning signs and what to do next. Check a message.