Business email compromise

What it is

Business email compromise is the theft of a payment that was going to happen anyway.

Nobody is tricked into buying something imaginary. An organisation owes money to a supplier, or is completing a property purchase, or is paying a contractor. All of that is real. The only thing the attacker changes is where the money goes — and they change it from inside the conversation in which the payment was already being arranged.

That is what makes it so hard to catch at the message level. The classic mental model of a scam email — odd grammar, a strange address, an attachment you were not expecting — describes a different crime. In its most damaging form, BEC involves no malware and no forged branding. Someone has read a genuine thread from inside a genuine mailbox, learned the tone and the timing, and sent a revised invoice at the moment it was expected.

The scale is difficult to overstate. Across complaints filed between October 2013 and December 2023, the FBI recorded $55.5 billion in global exposed losses, including 158,436 US victims and $20.1 billion in US exposed loss. In 2025 alone, IC3 recorded $3.05 billion from 24,768 complaints — fewer complaints than almost any consumer scam category, and the second-largest loss total of all of them.

How it actually works

1. Reconnaissance

   Who approves payments, who the suppliers are, when invoices fall due, who is travelling. Most of this is public: company filings, a website’s team page, LinkedIn, an out-of-office reply.

2. A mailbox is taken

   Credential phishing or a reused password, occasionally a stolen session token that walks past multi-factor authentication. Critically, it is often not your mailbox — it is a supplier’s, a conveyancer’s, or a smaller partner’s.

3. Quiet reading

   The attacker does nothing for days or months. Inbox rules divert replies so the real owner never sees the thread. This is where the tone, the approval chain and the payment cycle are learned, and it is why the eventual email reads correctly.

4. The real conversation is joined

   A genuine invoice thread receives a revised invoice with different bank details. Or a reply arrives from a lookalike domain — one character different, or a different top-level domain — that continues the thread as though nothing changed.

   Where it could have stopped

   The change of bank details is the scam, whatever explanation accompanies it. Confirm every change of payment details by calling a number you already had for that supplier — never a number in the email, and never by replying to the thread, which the attacker may be reading.

5. Urgency, applied to the right person

   A completion deadline. An executive travelling and unreachable. A supplier threatening to stop work. The pressure is designed to remove the step where somebody would have checked.

6. The payment goes out

   Correctly authorised, through the normal process, by someone doing their job properly. No control fires, because from the system’s point of view nothing anomalous happened.

7. Discovery, days or weeks later

   The real supplier chases an unpaid invoice. By then the money has usually left the receiving account. IC3 records BEC funds increasingly going straight to custodial accounts at payment processors and crypto exchanges, which is precisely where a recall stops being possible.

Why it works

It exploits a correct process, not a mistake. Someone whose job is to pay invoices paid an invoice. There is no moment of carelessness to point at, which is one reason victims of BEC are so often blamed unfairly and so rarely willing to discuss it.

The trust is pre-existing. The supplier is real, the project is real, the amount is right, the thread has your own earlier messages in it. Everything checks out except the eleven digits nobody verifies.

Authority is applied where it is hardest to refuse. In the CEO-fraud variant the request comes from someone whose emails are not usually questioned, and questioning it has a social cost inside an organisation. That cost is the attack surface.

Urgency arrives at a real deadline. BEC does not have to invent time pressure. Completions, month end and payment terms supply it, and the attacker only has to arrive at the right moment — which reading the mailbox tells them.

Small organisations have no second person. The single control that reliably stops this is another human confirming the change on a different channel. Charities, schools, small contractors and conveyancers are over-represented in enforcement records because that person does not exist.

And detection is aimed at the wrong layer. Email security is built to find bad messages. This is a good message with wrong bank details, sent by an account that is entitled to send it.

Where it comes from

The enforcement record on BEC is unusually rich, because unlike compound-based fraud, the money side of it touches the US and European banking systems directly, and that is where prosecutions start.

Documented networks have repeatedly involved West African organised crime, particularly Nigerian groups operating both from Nigeria and from diaspora communities in the United States, Canada and Europe. That is not a generalisation from a stereotype — it is the pattern in the case record, and it is a statement about specific criminal enterprises and their structure, not about a nationality. The Justice Department action documented on this page involved a Houston-based conspiracy of at least seven people in the United States and Nigeria, coordinating over WhatsApp.

The structure of that record is more useful than the geography. The people who compromise mailboxes, the people who send the emails, the people whose accounts receive the money and the people who convert it into exportable goods are usually different people, connected loosely and paid in shares. The conspiracy prosecuted in Houston laundered proceeds from business email compromise, romance fraud and unemployment insurance fraud — it was a laundering service, not part of any single scheme.

Eastern European and Russian-speaking groups appear more often in the credential-theft and initial-access half of the market, selling mailbox access rather than running the fraud themselves. The division of labour is why disrupting one part of the chain moves the problem rather than ending it.

Real cases

Red flags

• Any change of bank details. New account, new bank, “our usual account is under audit”. This is the scam. There is no benign version that arrives by email.
• Pressure to pay before a deadline that has just been brought forward, or that you are hearing about for the first time.
• A request that arrives while the approver is travelling, at a conference, or otherwise hard to reach by phone.
• A reply-to address that differs from the sender, or a domain that is one character out — a swapped letter, an added hyphen, .co instead of .com.
• Instructions not to discuss the payment because of an acquisition, a legal matter or an audit.
• A thread that resumes after a gap with a slightly different writing style, or that suddenly drops other recipients.
• An invoice for the right amount at the right time that you were not expecting to receive quite yet.
• A phone call confirming the emailed details using a number supplied in the email. That is not verification; it is the same channel twice.
• Payroll change requests asking to redirect someone’s salary to a new account.
• Conveyancing details arriving by email at all, close to completion. This variant costs individuals their entire deposit.

If it’s happening to you

If you think a payment has just gone to the wrong account, the next hour matters more than anything else you will do.

1. Call your bank immediately and ask for a recall of the funds, plus any indemnification paperwork they need. Say the words “business email compromise” — most banks have a specific process.
2. Ask the bank to contact the receiving bank directly. Speed is everything: IC3’s recovery process works on funds that are still sitting in the receiving account.
3. Report it the same day. In the US, file at ic3.gov — the FBI’s Recovery Asset Team works through a Financial Fraud Kill Chain that needs the report fast. Elsewhere, see where to report. IC3 advises filing regardless of the amount.
4. Assume the mailbox is still compromised. Do not discuss the incident on the affected email system. Reset passwords, revoke sessions, and check for forwarding and inbox rules the attacker created — those rules are often the only artefact left behind.
5. Warn the counterparty on a known-good number. If the compromise was theirs, other customers are being targeted right now.
6. Preserve the emails with full headers, not screenshots. They are the evidence.
7. Tell your insurer if you hold cyber or crime cover; many policies have short notification windows.

Preventing the next one. One rule does most of the work: a change of payment details is confirmed by voice, on a number you already held, by a second person, before the payment goes out. Everything else — payment thresholds, sender warnings on external email, blocking lookalike domains, phishing- resistant MFA — helps, but that one rule is the control that has to hold.

Where the money goes

A redirected payment lands in a receiving account that has been prepared for it — sometimes a mule account, sometimes a real company’s account whose owner has been recruited or deceived. It rarely stays there for more than a few hours.

From there the money splits and converts. IC3 records a growing share going directly to institutions holding custodial accounts for third-party payment processors, to peer-to-peer processors and to cryptocurrency exchanges — routes that were not the norm when the recall process was designed. In 2025, 86% of reported BEC transactions went by wire transfer or ACH, the fastest and least reversible conventional rail.

The end of the chain is often physical. The Houston conspiracy converted its share into salvaged cars bought at US auctions and shipped to Nigeria — a legitimate export, with paperwork, a real buyer and a value that survives the crossing.

By the numbers

No agency publishes a line item for most of the schemes on this site, so these charts show the official categories that contain this scheme. Each series is labelled with the agency's own category name. See how the mapping works.