Is Business Email Compromise the same as phishing?

Business Email Compromise is a form of phishing, but it is usually more targeted and financially motivated. BEC attacks often use impersonation, urgency, and real business context instead of generic spam language.

What is an example of a BEC scam?

A common example is a fake email that appears to come from a CEO or vendor requesting an urgent wire transfer or asking accounting staff to change banking details for a legitimate invoice.

Business Fraud • Business Email Compromise (BEC)

What Is Business Email Compromise (BEC)?

Q: What is Business Email Compromise?

Business Email Compromise, or BEC, is a scam where attackers impersonate executives, employees, vendors, or trusted contacts to trick a business into sending money, changing payment information, or sharing sensitive data.

Q: What should an employee do if a BEC email seems suspicious?

Pause the request, do not use contact information supplied in the suspicious email, and verify the request through a known phone number, internal directory, or established vendor contact before sending money, changing payment details, or releasing sensitive information.

Business Email Compromise (BEC) is a targeted scam where attackers impersonate trusted people or companies to trick employees into sending money, changing payment details, or sharing sensitive business information.

Explore Business Scam Training View Business Articles

Business-focused education

Email impersonation threats

Payment fraud prevention

Quick takeaway

If an email asks for an urgent payment, invoice update, or bank detail change, verify it through a separate trusted contact method before taking action.

Verified by GonePhishing.com

Business Email Compromise, often shortened to BEC, is one of the most costly and dangerous forms of business fraud. In a BEC scam, a criminal pretends to be a trusted person or organization and convinces someone inside a company to send money, change banking information, purchase gift cards, release payroll data, or share sensitive internal records.

Unlike many broad phishing campaigns, BEC attacks are usually more targeted. The attacker may research the company, study employee names and job roles, monitor invoice timing, or even compromise a real email account before sending the fraudulent request. Because the message often looks normal and appears to come from a boss, coworker, vendor, attorney, or business partner, employees may respond before verifying it.

What is Business Email Compromise?

Business Email Compromise is a scam that uses email impersonation, account compromise, or spoofed communication to trick businesses into making a fraudulent payment or disclosing sensitive information. In simple terms, it is a trust-based attack designed to exploit normal business processes.

A BEC attack does not always rely on malware or obvious phishing language. Many of these scams are short, direct, and believable. A message might say, “Are you available?” followed by a request for a same-day wire. Another might reference a real invoice and ask accounts payable to send funds to a “new” bank account. That realism is exactly what makes BEC so effective.

How Business Email Compromise (BEC) scams work

Most BEC attacks follow a pattern. First, the scammer identifies a valuable target such as an office manager, controller, payroll employee, HR representative, bookkeeper, or executive assistant. Then the attacker either spoofs an email address, registers a lookalike domain, or gains access to a legitimate mailbox. Once they understand the company’s communication style and approval habits, they send a message that appears routine but is actually fraudulent.

An attacker studies the company, employees, vendors, or payment routines
They spoof or compromise an email account to appear legitimate
They send a request involving money, banking changes, tax records, payroll, or sensitive files
The message uses urgency, authority, secrecy, or timing pressure
The employee acts before verifying the request through a trusted separate channel

Common examples of BEC scams

Business Email Compromise can take several forms. Some scams focus on executive impersonation. Others target payments, payroll, or data access. The underlying tactic is the same: the criminal uses trust and business context to get past skepticism.

CEO fraud: A scammer impersonates an owner, CEO, or senior executive and requests an urgent confidential wire transfer.
Vendor invoice fraud: The attacker pretends to be a real supplier and asks the company to update payment instructions for an invoice.
Payroll diversion: The criminal impersonates an employee and requests a direct deposit change so wages are sent to the wrong account.
Attorney impersonation: A fake lawyer or legal contact pressures staff to send money or documents immediately.
Account compromise: A real email account is taken over and used to send believable internal or vendor requests.
Data theft BEC: HR, payroll, or finance staff are tricked into sending tax forms, W-2 data, employee records, or confidential files.

Why BEC attacks are so dangerous

BEC scams are dangerous because they do not always look like traditional phishing. There may be no attachments, no obvious malicious links, and no poor grammar. Instead, the attacker relies on business timing, authority, and familiarity. A short email from “the CEO” during a busy day may feel more trustworthy than a flashy spam message.

These scams also target processes that involve real money and sensitive records. If an employee sends a wire, changes vendor banking details, or transmits payroll data before verifying the request, the loss can be immediate and severe.

Red flags of Business Email Compromise

While BEC messages can look convincing, they often contain warning signs. Employees should slow down any financial or sensitive-data request that creates pressure or tries to bypass normal procedures.

Urgent requests involving wires, ACH payments, gift cards, or account updates
Instructions to keep the request secret or avoid normal approval channels
New banking details, changed remittance information, or invoice rerouting
Email addresses or domains that look almost correct but not exact
Requests that do not match normal process, timing, or authority levels
Messages that ask for payroll records, tax forms, or employee data unexpectedly
Replies that push for immediate action when someone asks to verify

How to react to a suspected BEC request

If a payment, banking, payroll, invoice, or sensitive-data request feels unusual, the safest response is to slow the process down. You do not need to accuse the sender of being a scammer. Your job is to verify the request through a separate trusted channel before taking action.

Pause the request. Do not send money, change banking details, buy gift cards, or release sensitive information yet.
Do not reply using the contact information in the suspicious message. Use a phone number, internal directory, vendor record, or contact method you already trust.
Verify the person and the request separately. Confirm both who made the request and whether the requested change is legitimate.
Follow normal approval procedures. An urgent message should not be allowed to bypass established financial or data-release controls.
Report the message internally. Notify the appropriate manager, finance contact, IT/security team, or business owner so other employees can be warned.

What employees can say when a BEC request feels suspicious

Employees should be able to verify unusual requests without worrying that they are being difficult or slowing down the business. Short, professional responses can create the time needed to check the request safely.

“Before I process this payment or account change, I need to verify it through our normal approval process.”

“We verify banking-detail changes using the contact information already on file. I will call the vendor directly.”

“I cannot release payroll, tax, or employee information until I independently confirm this request.”

How to prevent Business Email Compromise

The best defense against BEC is a combination of employee training, strong internal controls, and technical protection. No single safeguard is enough on its own. Businesses reduce risk most effectively when employees are trained to pause, verify, and follow documented procedures.

Train employees regularly on phishing, executive impersonation, and invoice fraud
Require independent verification for bank changes and payment requests
Use known phone numbers or approved contacts, not the information in the suspicious email
Enable multi-factor authentication on email and admin accounts
Review email security controls, domain protection, and login alerts
Use approval workflows for wires, ACH changes, and sensitive data release
Limit who can change payment details or access payroll and finance systems

What to do if your business is targeted by a BEC scam

If your company receives a suspicious request, do not send payment or confidential information until the request is independently verified. Contact the supposed sender through a known phone number, internal directory, or established vendor contact instead of relying on the information in the suspicious email.

If money, credentials, or sensitive information may already have been exposed, act quickly:

Contact your financial institution immediately and ask about a wire recall, transfer hold, fraud review, or other available recovery steps.
Preserve the original email and related evidence, including message headers, invoices, payment instructions, phone numbers, and transaction details.
Notify internal leadership, finance, and IT/security so the organization can determine whether other employees or accounts were targeted.
Review the affected mailbox for unfamiliar forwarding rules, filters, recovery methods, active sessions, or suspicious logins.
Change compromised credentials and review multi-factor authentication if an email or business account may have been accessed.
Warn the legitimate vendor or business contact if their name, invoice, or account may have been impersonated.
Report BEC fraud to the FBI Internet Crime Complaint Center (IC3) when appropriate.

For immediate GonePhishing response guidance, read: What to Do If Your Business Sent a Wire to a Scammer.

Business Email Compromise vs phishing

Business Email Compromise is part of the broader phishing family, but it is usually more targeted and more financially focused than general phishing emails. A generic phishing attack might try to steal passwords from thousands of people. A BEC attack is more likely to target one company, one invoice, one payroll employee, or one executive assistant with a carefully timed fraudulent request.

In other words, all BEC attacks are phishing-related social engineering attacks, but not all phishing attacks are Business Email Compromise.

Frequently asked questions

What does BEC stand for?

BEC stands for Business Email Compromise. It refers to scams where attackers use email impersonation or account compromise to trick businesses into sending money or sensitive data.

What is the most common BEC scam?

Common BEC scams include fake executive payment requests, vendor invoice fraud, payroll direct deposit changes, and fraudulent banking updates tied to legitimate-looking invoices.

Can BEC happen without hacking an email account?

Yes. Some BEC scams use spoofed or lookalike email addresses instead of a fully compromised account. Even without account takeover, the scam can still look convincing.

Who is most at risk for Business Email Compromise?

Accounting teams, payroll staff, finance departments, HR personnel, executive assistants, office managers, and anyone involved in approvals, invoices, or employee records are frequent targets.

What should an employee do if a BEC email seems suspicious?

Pause the request and verify it through a separate trusted contact method. Do not use a phone number, email address, or payment information supplied only in the suspicious message. If the request involves money or sensitive information, follow the company’s normal approval process before taking action.

Trusted BEC resources

The FBI identifies Business Email Compromise as a serious form of online fraud and recommends independently verifying payment changes and contacting your financial institution immediately if funds have already been sent. Businesses can also report BEC incidents through the FBI Internet Crime Complaint Center.