How to safeguard against BEC attacks

Email is how business gets done around the world, making it the perfect target for business email compromise (BEC). Yet unlike most cyberthreats, BEC rarely announces itself. There's no malicious attachment to quarantine, no dangerous link to block. Instead, an attacker sends a plain, well-worded email—a message that looks exactly like the everyday correspondence your employees trust—and asks someone to do something entirely routine: pay an invoice, update banking details, buy gift cards, or forward a sensitive file. The whole scam hinges on impersonation and timing, not code.

What is business email compromise?

At its core, BEC is a confidence trick delivered by email. An attacker either spoofs or compromises a legitimate-looking account—often that of a CEO, CFO, vendor, or trusted partner—and uses it to manipulate an employee into transferring money or data. Common variations include CEO fraud (a spoofed executive urgently requesting a wire transfer), vendor or invoice fraud (a supplier's real account is hijacked and payment redirected to a fraudulent account), payroll diversion, and gift card scams. Increasingly, attackers do their homework first, studying an organization's org chart, vendor relationships, and even writing style so their requests feel authentic.

What makes BEC so dangerous is precisely what makes it hard to catch. These messages frequently carry no payload at all—no malware, no phishing URL—so signature-based defenses and traditional secure email gateways often wave them through. The FBI's Internet Crime Complaint Center has tracked BEC as one of the costliest cybercrimes for years, and the trend keeps climbing: losses moved from $2.94 billion in 2023 to $2.77 billion in 2024 and back up to $3.04 billion in 2025. The average loss per complaint now exceeds $122,000, and 86% of BEC funds move via wire transfer or ACH—meaning these attacks land squarely inside real financial workflows, where a single successful message can cost an organization six or seven figures.

Why BEC is getting harder to stop

Two forces are making the problem worse. First, attackers have gone payloadless by design, stripping out the technical indicators that security tools are built to detect and leaning entirely on social engineering. Second, generative AI has lowered the barrier to entry: threat actors can now craft flawless, context-aware lures at scale, personalize them across languages, and eliminate the grammatical tells that once gave phishing away. The result is a higher volume of more convincing attacks arriving faster than any human team can manually review.