# How to prevent business email compromise (BEC)

URL: https://iblockspam.com/blog/business-email-compromise-prevention
Last updated: 2026-10-09
Published: 2026-10-09
Topic: Phishing & threats
Author: iBlockSpam Team

> What business email compromise is, what the FBI's 2025 IC3 figures show, and the payment checks and technical controls that stop BEC fraud at small firms.

## Short answer

Business email compromise is fraud where a criminal poses as a boss, colleague or supplier by email to get money or data. Prevent it with a written payment-change procedure that verifies requests by phone on a known number, dual approval for transfers, MFA on every mailbox, DMARC enforcement, impersonation filtering and external-sender tags.

Business email compromise (BEC) doesn't need malware or a clever exploit. It needs one convincing email and one person who follows its instructions. This guide explains how BEC works, what the latest FBI figures show, and the procedures and technical controls that stop it.

## What is business email compromise?

The FBI's Internet Crime Complaint Center (IC3) defines BEC as "a scam targeting businesses or individuals working with suppliers and/or businesses regularly performing wire transfer payments." Fraudsters compromise "email accounts and other forms of communication such as phone numbers and virtual meeting applications, through social engineering or computer intrusion techniques to conduct unauthorized transfer of funds" ([2025 IC3 Annual Report, Appendix B](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)).

In practice, BEC usually takes one of these forms:

| Scenario | What the email says | What the criminal wants |
|---|---|---|
| Supplier invoice fraud | "Our bank details have changed. Please pay this invoice to the new account." | Your next payment to a real supplier |
| Executive impersonation | "I'm in a meeting. I need you to send a wire today. Keep it quiet." | An urgent, unchecked transfer |
| Payroll diversion | "Please update my direct deposit to this new account." | An employee's salary |
| Account compromise | A real email from a real colleague's or supplier's mailbox | Anything: payment, data, more access |
| Gift card request | "Can you buy some gift cards for a client? I'll pay you back." | Card numbers sent by reply ([how the gift card scam works](https://iblockspam.com/blog/gift-card-scam-emails)) |

What links them is that the email looks routine. There's often no link and no attachment, so there's nothing for a malware scanner to catch.

## How big is the BEC problem?

The IC3's [2025 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) gives the most recent official US figures:

| Measure (IC3 complaints) | 2025 | 2024 | 2023 |
|---|---|---|---|
| BEC complaints | 24,768 | 21,442 | 21,489 |
| BEC reported losses | $3,046,598,558 | $2,770,151,146 | $2,946,830,270 |

Some context from the same report:

- Across all crime types, IC3 received 1,008,597 complaints in 2025, with $20.877 billion in reported losses.
- BEC had the second-highest reported losses of any crime type in 2025, after investment fraud ($8,648,617,756).
- Businesses reported losses of over $30 million to BEC scams involving AI, such as chat-generated emails that mimic a CEO or voice cloning to request a wire payment.
- Complainants aged 60 and over filed 4,566 BEC complaints, with $568,048,472 in losses.

A separate [IC3 public service announcement from September 2024](https://www.ic3.gov/PSA/2024/PSA240911) put the total "exposed dollar loss" from BEC at $55,499,915,582 between October 2013 and December 2023, domestic and international.

These numbers only count what victims reported to IC3. They're a floor, not a ceiling.

## How does a BEC attack work?

Most BEC follows a predictable sequence. Knowing it tells you where to put controls.

1. **Research.** The criminal learns who approves payments, who your suppliers are and how your staff write. Company websites, LinkedIn and old leaked emails all help.
2. **A sending identity.** They need an address the target will trust. Options are spoofing your exact domain, registering a [lookalike domain](https://iblockspam.com/blog/lookalike-domain-phishing), using a free webmail account with a familiar display name, or breaking into a real mailbox.
3. **The request.** A plausible message: a changed bank account, an urgent wire, an updated payroll record. It often arrives at a busy time or when the "sender" is said to be traveling.
4. **Pressure.** Urgency and secrecy stop the target from checking. "Don't call, I'm in meetings all day."
5. **Cash-out.** Money goes to an account controlled by the criminal or a money mule and is moved on quickly.

Technical controls work on steps 2 and 3. Procedures work on steps 3 to 5. You need both, because a message from a genuinely compromised supplier mailbox can pass every technical check. Generative AI makes step 3 more convincing, as our guide to [AI phishing emails](https://iblockspam.com/blog/ai-phishing-emails) explains, and some attackers [flood an inbox with sign-up emails](https://iblockspam.com/blog/email-bombing-subscription-bombing) to bury a fraud alert while they work.

## What payment verification procedures stop BEC?

The FBI's first prevention tip is to "use secondary channels and/or two-factor authentication to verify requests for changes in account information" ([IC3 PSA, 2024](https://www.ic3.gov/PSA/2024/PSA240911)). Turn that into a written rule that applies to everyone, including the owner.

### A payment-change procedure you can adopt

1. **Never act on bank details received by email alone.** This includes PDFs, invoice footers and replies in an existing thread.
2. **Call back on a number you already hold.** Use the number from your supplier master file, a previous contract or the supplier's official website. Never use a phone number from the email that asked for the change.
3. **Speak to someone you know.** Ask them to confirm the old account, the new account and the reason for the change.
4. **Record the check.** Note who you called, on which number, when, and who confirmed. Store it with the supplier record.
5. **Require a second approver.** Any change to bank details, any first payment to a new payee, and any transfer above a threshold you set needs two people.
6. **Hold the first payment if anything feels off.** A short delay costs little. A wire to a criminal is usually gone within hours.
7. **Apply the same rule to payroll.** Direct deposit changes go through HR's own portal or an in-person or video check, never an emailed request.

### Rules for "urgent" requests from executives

- Agree in advance that no executive will ever ask for a wire, gift cards or secrecy by email.
- Make it safe to say no. Staff should be thanked, not blamed, for delaying a payment to check it.
- Use a known phone number or an internal chat channel to confirm. Don't reply to the email.

These rules cost nothing and stop the attack even when the email is technically perfect. They matter just as much where volunteers handle money; see [email security for nonprofits](https://iblockspam.com/blog/email-security-for-nonprofits).

## Which technical controls reduce BEC?

Procedures catch what gets through. Technical controls reduce how much gets through.

### 1. Multi-factor authentication on every mailbox

Account takeover turns a criminal into a trusted insider. The joint [CISA, NSA, FBI and MS-ISAC phishing guidance](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf) recommends MFA and prioritizes phishing-resistant MFA for administrator and privileged accounts. Start with finance staff, executives and admins.

### 2. DMARC enforcement on your own domain

The same CISA guidance recommends DMARC, set to "reject" for sent email. At `p=quarantine` or `p=reject`, receivers can refuse mail that forges your exact domain. That stops criminals emailing your suppliers "from" your finance team. In [our scan of the Tranco top 1,000 domains](https://iblockspam.com/research/email-security-top-1000) in October 2026, 38.3% didn't enforce DMARC. Check yours with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker), and follow our [staged rollout to p=reject](https://iblockspam.com/blog/dmarc-none-to-reject-small-business).

DMARC protects your domain, not your suppliers'. It does nothing against a lookalike domain.

### 3. Impersonation and lookalike-domain filtering

Inbound filtering should look for display names that match your executives, domains that resemble yours or your suppliers', and senders that fail authentication. In Microsoft 365, user and domain impersonation protection are part of Defender for Office 365, not the basic protection every cloud mailbox gets. Microsoft notes that impersonation "can pass email authentication checks (SPF, DKIM, and DMARC) if the attacker created a lookalike domain" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about)). Our guide to [stopping phishing in Microsoft 365](https://iblockspam.com/blog/stop-phishing-emails-microsoft-365) covers the settings.

### 4. External sender tags

A visible "External" label makes "the CEO" emailing from outside the company stand out. Exchange Online has a native option, enabled with `Set-ExternalInOutlook -Enabled $true`. Microsoft says it can take 24 to 48 hours for the tag to appear ([Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-externalinoutlook?view=exchange-ps)).

### 5. First-contact warnings

Microsoft's first contact safety tip warns a recipient when they don't often get email from a sender. It's available in anti-phishing policies for all cloud mailboxes, and Microsoft recommends turning it on. A changed supplier address often triggers it.

### 6. Watch for signs of a compromised mailbox

Review new inbox rules that forward, move or delete mail, sign-ins from unexpected places, and sudden changes to mailbox forwarding. Criminals inside a mailbox often hide replies from the real owner while they work. Our guide to the [signs an email account is compromised](https://iblockspam.com/blog/signs-email-account-compromised) lists what to look for and the full recovery checklist. A Microsoft 365 user suddenly [blocked from sending](https://iblockspam.com/blog/microsoft-365-user-blocked-from-sending) is often the first visible sign.

### 7. Report quickly and easily

Give staff one obvious way to report a suspicious email. CISA's guidance stresses teaching staff the importance of reporting suspicious emails, and encourages using the reporting features built into Outlook and other cloud email platforms.

## What should you do if a BEC payment has already gone out?

Speed matters most. The IC3's Recovery Asset Team works with banks to freeze funds through its Financial Fraud Kill Chain. In 2025 it handled 3,900 incidents across all fraud types, with $1,163,919,846 in attempted theft and $679,013,183 frozen, a 58% success rate ([2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)).

1. Call your bank at once. Ask for a recall of the funds and what indemnification documents it needs.
2. File a complaint at [ic3.gov](https://www.ic3.gov), whatever the amount. Include the full transaction details.
3. Reset the password and revoke sessions for any mailbox that may be compromised, and check its inbox rules.
4. Warn the real supplier or executive whose identity was used.
5. Keep the original email with its full headers. The [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) shows where it really came from.

## BEC prevention checklist

| Control | Owner | Stops |
|---|---|---|
| Written payment-change procedure with callback | Finance | Invoice and payroll fraud |
| Dual approval above a threshold | Finance | Single-person mistakes |
| MFA on all mailboxes | IT | Account takeover |
| DMARC at quarantine or reject | IT | Exact-domain spoofing of you |
| Impersonation and lookalike filtering | IT | Fake executives and suppliers |
| External sender tags | IT | Outside mail posing as internal |
| One-click reporting | IT and staff | Slow detection |
| Incident plan with bank contact numbers | Finance | Lost recovery time |

## Next steps

1. Write down your payment-change procedure this week and share it with everyone who can pay or approve an invoice.
2. Turn on MFA for every mailbox, starting with finance and leadership.
3. Run your domain through the free [Email Health Check](https://iblockspam.com/tools/email-health-check) to see where SPF, DKIM and DMARC stand.
4. Review how your inbound filtering handles impersonation. If you want domain-level filtering in front of Microsoft 365, Google Workspace or cPanel, see [how iBlockSpam works](https://iblockspam.com/how-it-works).

Related: [fake invoice and payment emails](https://iblockspam.com/blog/fake-invoice-and-payment-emails) and [vendor invoice fraud and payment redirection](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection). Many BEC attempts use a domain that looks like yours; iBlockSpam's [Lookalike Domain Watch](https://iblockspam.com/features/lookalike-domain-watch) checks for those daily and alerts you when one is registered.

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### What is the most common type of business email compromise?

The classic pattern is a payment redirect. A criminal poses as a supplier or executive and asks for an invoice to be paid to a new bank account, or for an urgent wire. The IC3 defines BEC around businesses that work with suppliers or regularly make wire transfer payments.

### How much money is lost to BEC each year?

In its 2025 annual report, the FBI's Internet Crime Complaint Center recorded 24,768 BEC complaints with reported losses of $3,046,598,558. Only investment fraud had higher reported losses. These are complaints filed with IC3, so the real total is likely higher.

### Can a spam filter stop business email compromise?

It helps, but it can't stop everything. Filtering catches spoofed senders, known bad infrastructure, lookalike domains and malicious links. A message from a supplier's real, compromised mailbox can pass every check. That's why a payment verification procedure by phone is the control that matters most.

### What should I do if we paid a fraudulent invoice?

Act immediately. Call your bank, ask for a recall of the funds and ask what paperwork it needs. Then file a complaint at ic3.gov with the full transaction details, whatever the amount. The FBI says time is of the essence for freezing funds.

### Does DMARC stop BEC?

DMARC at p=quarantine or p=reject stops criminals sending mail that uses your exact domain in the From address. It doesn't stop lookalike domains, display-name tricks or a compromised supplier mailbox. Treat it as one layer, alongside impersonation filtering and payment checks.

## Sources

- [FBI IC3: 2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [FBI IC3 PSA: Business Email Compromise: The $55 Billion Scam (2024)](https://www.ic3.gov/PSA/2024/PSA240911)
- [CISA, NSA, FBI, MS-ISAC: Phishing Guidance: Stopping the Attack Cycle at Phase One](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf)
- [Microsoft Learn: Anti-phishing policies in Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about)
- [Microsoft Learn: Set-ExternalInOutlook](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-externalinoutlook?view=exchange-ps)

## Free tools for this guide

- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/business-email-compromise-prevention (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt