Business email compromise (BEC)

Business email compromise, or BEC, is a scam in which criminals use fake or hacked email accounts to trick organisations into sending money or sensitive data. The criminal may pretend to be a supplier with new bank details, a senior manager requesting an urgent transfer, a lawyer handling a confidential deal, or a colleague asking HR to change where their salary is paid. Because some attackers break into real accounts, the email may come from the genuine address and even reply in an existing conversation. FBI figures show BEC causes billions of dollars in losses each year. Callbacks on known numbers and two-person approval for payment changes stop most attempts.