An email lands in your controller’s inbox. It looks like it’s from the CEO, references a real vendor, and asks for a wire transfer to close out an urgent deal before the end of the day. Nothing about it looks fake — the tone matches, the signature is right, even the timing makes sense. That’s business email compromise, and it’s quietly become one of the most expensive forms of cybercrime hitting small and mid-sized businesses today.

Business email compromise, or BEC, doesn’t rely on malware, ransomware, or a dramatic breach. It relies on trust. A scammer impersonates someone you already do business with — a boss, a vendor, a bank contact — and asks you to do something that feels completely normal: pay an invoice, update a bank account, send a batch of gift cards. By the time anyone realizes something’s wrong, the money is usually gone.

What Business Email Compromise Actually Looks Like

BEC attacks don’t look like typical phishing emails with obvious red flags. There’s rarely a suspicious attachment or a broken link. Instead, attackers spend time researching a company — scraping LinkedIn, press releases, and even hacked email threads — to learn who approves payments, who the real vendors are, and how the business actually communicates.

Then they strike with one of a few familiar plays:

• Executive impersonation: An email that appears to come from a CEO or CFO asking for an urgent, confidential wire transfer.
• Vendor invoice fraud: A “vendor” sends an invoice with updated bank details, redirecting a legitimate payment into the attacker’s account.
• Payroll diversion: An employee’s direct deposit information is “updated” by someone pretending to be HR or the employee themselves.
• Gift card scams: A fake executive asks an employee to buy gift cards for a “client gift” and send over the codes.

Each version plays on the same thing: urgency plus authority. The request feels time-sensitive and comes from someone the employee doesn’t want to question.

Why Business Email Compromise Is Getting Worse

The dollar figures back up what IT teams have been seeing for years. Business email compromise took the No. 2 spot among all cybercrime categories in 2025, with almost $3.05 billion in losses, trailing only investment fraud, according to CyberScoop’s coverage of the FBI’s 2025 Internet Crime Report. That’s a jump from 21,442 BEC complaints and $2.77 billion in losses the year before, based on year-over-year FBI IC3 figures.

Zoom out and the trend is even clearer. Total cybercrime losses reported to the FBI reached almost $20.9 billion last year, a 26% increase over 2024, per the same FBI report coverage. BEC accounts for a disproportionate share of that total because the scams work — there’s no malware for antivirus software to catch and no network intrusion for a firewall to block. It’s a well-written email and a distracted employee.

Artificial intelligence is adding a new wrinkle. The FBI’s 2025 report included, for the first time, a dedicated section tracking roughly $893 million in AI-related fraud, according to an analysis of the report geared toward smaller businesses. Attackers are using AI tools to write cleaner, more convincing emails and, in some cases, to clone voices for a follow-up phone call that makes the scam feel even more legitimate. We’ve written before about how everyday AI tools can create unexpected risk inside a business — BEC is one more example of attackers putting that same technology to work against you.

Who Gets Targeted

BEC doesn’t discriminate by company size. In fact, smaller businesses are often more attractive targets because they’re less likely to have formal payment-verification processes, dedicated finance teams, or 24/7 IT monitoring. A 10-person accounting firm or a 50-person manufacturer can lose six figures just as easily as a large enterprise — and usually has far less room to absorb the loss.

Construction, real estate, legal services, and healthcare are frequent targets because they regularly move large sums of money through email-based approval chains — closing costs, vendor payments, insurance claims. If your business routinely wires money or changes banking details based on an email request, you’re a candidate.

Practical Steps That Actually Reduce Risk

You don’t need an enterprise security budget to meaningfully lower your BEC risk. A handful of practical habits go a long way:

• Verify payment changes out-of-band. Any request to change bank details or wire funds should be confirmed by phone, using a number you already have on file — never one provided in the email itself.
• Turn on multi-factor authentication everywhere. Even if a password is stolen through a phishing page, MFA stops most attackers from actually logging into the mailbox.
• Set up email authentication. SPF, DKIM, and DMARC records make it harder for attackers to spoof your domain and help filter out messages that try to impersonate you.
• Create a two-person rule for large payments. No single employee should be able to approve and send a wire transfer over a set dollar threshold without a second signoff.
• Train staff on what urgency looks like. Most BEC emails push for speed and secrecy. A quick reminder that “urgent and confidential” is a red flag, not a reason to skip verification, helps employees pause before acting.
• Monitor mailbox rules and login activity. Attackers who gain access to a real account often set up hidden forwarding rules to monitor conversations before striking. Regular review of mailbox rules can catch this early.

Automated monitoring tools can also flag unusual login locations, impossible travel, or new forwarding rules faster than a person checking manually — which is part of why automation has become such a useful layer in cybersecurity defense for businesses without a large internal IT team.

If You Think You’ve Already Been Hit

Speed matters more than almost anything else once a fraudulent wire goes out. Contact your bank immediately and ask them to initiate a recall or hold on the transfer, then file a complaint with the FBI’s Internet Crime Complaint Center (IC3) at ic3.gov. The FBI’s Recovery Asset Team exists specifically to work with banks on freezing fraudulent transfers before the money disappears — it froze more than $507 million in fraudulent domestic wires in 2025, according to BEC statistics compiled from FBI IC3 data. That kind of recovery only works when businesses report quickly, often within 24 to 72 hours.

After the immediate response, change passwords, review mailbox rules, and check whether other accounts were accessed. It’s also worth having an IT partner review what happened so you can close the specific gap that let it through.

Business Email Compromise Isn’t Going Away — But You Can Make Yourself a Harder Target

BEC thrives on routine, trust, and a moment of distraction. The good news is that the defenses that work — verification habits, MFA, email authentication, and basic staff awareness — don’t require a massive investment to put in place. They just require consistency.

If you’re not sure how your business would hold up against a well-crafted BEC attempt, a managed IT partner can review your email security setup, test your current safeguards, and help you put practical verification steps in place before a scammer tests them for you.