Business Email Compromise Cost $2.9B in 2025 — A Tactical Breakdown

Business Email Compromise is a category of fraud in which attackers use email; either a compromised legitimate account or a convincing spoofed address to deceive employees into transferring funds, changing payment details, or disclosing sensitive information.
The defining characteristic of BEC is social engineering rather than malware. There are typically no malicious attachments, no exploit code, and no payload for antivirus to detect. The weapon is a convincingly worded email from what appears to be a trusted sender.

The Five BEC Archetypes
The FBI categorises BEC into five primary attack types:
1. CEO Fraud: The attacker impersonates a senior executive (CEO, CFO, or Chairman) and emails the finance team requesting an urgent wire transfer, typically to a new supplier or for a confidential acquisition. The urgency and authority of the sender discourages the recipient from verifying through normal channels.
2. Vendor Email Compromise: The attacker compromises a legitimate supplier’s email account and sends updated bank account details to the target organisation, redirecting future payments to an attacker-controlled account. This variant is particularly dangerous because it comes from a genuine email address.
3. Account Compromise: An employee’s email account is compromised and used to request invoice payments from customers or colleagues. The attacker often monitors the compromised inbox for weeks before acting, learning communication patterns and timing attacks around expected payments.
4. Attorney Impersonation; particularly common in real estate transactions, the attacker impersonates a solicitor or conveyancer and sends fraudulent wire transfer instructions for property purchases. Losses in individual cases frequently exceed £100,000.
5. Data Theft BEC; rather than requesting money, the attacker requests sensitive employee or financial data — W-2 forms, payroll information, or employee personally identifiable information which is then used for tax fraud or identity theft.
Who Is Losing the Most Money?

The IC3 2025 data reveals a clear targeting pattern by industry:
Real estate — the highest average loss per incident. Property transactions involve large single transfers, tight deadlines, and multiple parties communicating via email — ideal conditions for BEC fraud. UK conveyancing fraud has become a significant problem, with the Solicitors Regulation Authority issuing multiple warnings about conveyancer email compromise.
Manufacturing — frequent large supplier payments, complex supply chains with multiple vendors, and often weaker email security than financial sector peers make manufacturing a prime target.
Healthcare — high-value equipment procurement, insurance billing fraud, and the sheer volume of inter-organisation payments make healthcare a consistent BEC target.
Legal services — law firms hold client funds in escrow, handle large transactions on behalf of clients, and communicate sensitive financial information via email routinely.
Local government — particularly relevant for UK organisations. Multiple councils have suffered significant BEC losses in recent years, with attackers intercepting supplier payment communications.

Anatomy of a Successful BEC Attack
Understanding how BEC attacks actually unfold is essential for building effective defences.
Phase 1: Reconnaissance
Before sending a single email, sophisticated BEC actors spend time on open-source intelligence (OSINT) gathering. LinkedIn reveals organisational structure — who reports to whom, who handles finance, who has authority to approve transfers. Company websites reveal email formats. Job postings reveal internal systems and processes. Annual reports reveal key suppliers and financial relationships.
Phase 2: Initial Access or Spoofing
The attacker either:
Registers a lookalike domain (e.g. `comp4ny.com` instead of `company.com`) to send spoofed emails, or
Compromises a legitimate email account via phishing or credential stuffing
Account compromise is the more dangerous variant because it bypasses email authentication controls entirely.
Phase 3: Monitoring
If operating from a compromised account, the attacker sets up forwarding rules to monitor inbound email without the account owner noticing. They look for: upcoming invoice payments, supplier relationships, executive travel schedules (executives are often impersonated during travel when they’re less reachable for verification), and pending large transactions.
Phase 4: Intervention
The attacker intervenes at the optimal moment — typically when a legitimate payment is being processed — either modifying a legitimate invoice or sending a spoofed update to payment details.
Phase 5: Mule Network
Funds are transferred to a money mule account — often a legitimate bank account belonging to an unwitting individual recruited through a fake job advertisement — before being rapidly moved through multiple accounts and converted to cryptocurrency.

Technical Controls That Stop BEC
DMARC enforcement — the single most impactful technical control. DMARC with a `p=reject` policy prevents spoofed emails using your domain from reaching recipients. Every organisation should have DMARC configured at enforcement level.
Check your current DMARC status:
“`
nslookup -type=TXT _dmarc.yourdomain.com
“`
A result showing `p=none` means you have no enforcement. `p=quarantine` sends spoofed emails to spam. `p=reject` blocks them entirely.
Email authentication header inspection — train your email gateway to flag emails where the display name matches an internal executive but the sending domain does not match your organisation’s domain. This catches CEO fraud even without account compromise.
Lookalike domain monitoring — register common typosquat variants of your domain and monitor for new registrations that closely match your domain. Services like PhishScout’s intel feed and external tools can alert on newly registered lookalike domains.
Banner warnings for external email — configure your email platform to display a clear visual warning on all emails originating from outside your organisation. Simple but highly effective at prompting recipients to pause before acting on payment requests.

Procedural Controls That Stop BEC
Technical controls alone are insufficient. BEC attacks succeed by exploiting human processes.
Dual authorisation for all wire transfers — no single person should have the authority to initiate and approve a wire transfer. Any payment above a threshold (recommended: £5,000) should require sign-off from a second person via a channel other than email.
Out-of-band verification — any request to change bank account details or make an unusual payment should be verified by calling the requester on a known, previously verified phone number. Not a number provided in the email — a number from your existing records.
Callback procedures for new payees — before making any payment to a new bank account, call the recipient organisation directly using a number sourced independently to confirm the account details.
Executive travel alerts — inform the finance team when senior executives are travelling. BEC attackers frequently time CEO fraud attacks to coincide with executive travel when the impersonated individual is less contactable for verification.

What to Do If You’ve Been Hit
Speed is everything. Wire transfers can sometimes be recalled if action is taken within hours.
Immediately call your bank’s fraud line and request a recall of the transfer
Contact the receiving bank directly if you know it
Report to Action Fraud (UK): actionfraud.police.uk or 0300 123 2040
Preserve all email headers, wire transfer records, and communications
Engage your cyber incident response team or external IR support
Do not delete any emails — they are evidence

Conclusion
BEC is not a sophisticated technical attack, it is a sophisticated social engineering attack that exploits human psychology and organisational processes. The most effective defences combine technical controls (DMARC, email authentication, external sender warnings) with procedural controls (dual authorisation, out-of-band verification) and ongoing staff awareness.
The $2.9 billion lost in 2025 is largely preventable with the right controls in place.
—
Submit BEC phishing emails for analysis at phishscout.net
—