Business email compromise
Fraud that redirects a legitimate business payment by impersonating an executive, a supplier or a lawyer, usually from inside a compromised mailbox.
BEC is the highest-value scam per incident in most national datasets that break it out. It works on organisations rather than individuals, which is why the sums are larger: the target is a person whose job is to send money, being asked to do exactly their job.
The most damaging variant involves no malware at all. An attacker sits inside a compromised mailbox reading a real payment conversation, waits for the invoice, and sends a revised one from a lookalike domain at the right moment. The FBI reported $3.05 billion in BEC losses in the United States in 2025.
Where it shows up
- Business email compromise — Someone reads a real payment conversation from inside a real mailbox, then joins it with different bank details.
- Invoice and vendor fraud — A real invoice, for real work, from a real supplier — with eleven digits changed.