Business Email Compromise (BEC)
Also known as: BEC, CEO fraud, wire transfer fraud, invoice redirect scam
Scammers impersonate executives, vendors, or clients via email to trick businesses into wiring large sums of money or disclosing sensitive information. BEC is the most financially damaging category of scam targeting businesses, with average losses per incident exceeding $125,000.
Check if something looks like this scam
Paste any suspicious text, link, or phone number into our scanner.
How it works
Business Email Compromise is where scams become industrial-scale crime. Unlike consumer scams that might steal hundreds or thousands, BEC routinely steals hundreds of thousands to millions from a single target.
The research: Scammers identify targets through LinkedIn, company websites, and public records. They map organizational structures, identify CFOs and accounts payable staff, and understand how the company handles payments.
The access: Scammers compromise email accounts — either the executive's (via phishing) or a lookalike domain (microsoftt.com instead of microsoft.com). Sometimes they compromise a vendor the target company works with, then redirect legitimate invoices.
The five main BEC variants:
1. CEO fraud: The CFO receives an email 'from the CEO' requesting an urgent wire transfer, often for a 'confidential acquisition' or 'urgent business need.' The CEO is conveniently in a meeting and can't be called directly.
2. Vendor impersonation: The scammer compromises a supplier's email and sends a legitimate-looking invoice with updated payment details pointing to the scammer's account.
3. Attorney impersonation: An email claims to be from outside counsel handling a sensitive matter, urging wire transfer for legal fees or settlement.
4. Payroll diversion: HR receives an email 'from an employee' asking to update their direct deposit account — rerouting their paycheck to the scammer.
5. Data theft: Scammers request W-2 forms, customer lists, or financial records (not money, but valuable data for future fraud).
The AI evolution: In 2026, BEC is supercharged by AI. Scammers use voice cloning to make follow-up phone calls that sound exactly like the real executive. They use AI to generate contextual emails that reference real company events scraped from LinkedIn and press releases.
Warning signs
- ⚠Unexpected urgency from an executive about a wire transfer
- ⚠Request to change vendor payment details
- ⚠Email from a slightly-off domain (paypal-inc.com instead of paypal.com)
- ⚠Reluctance to communicate outside of email
- ⚠Request for confidentiality ('don't discuss this with anyone')
- ⚠Pressure to bypass standard approval processes
- ⚠Request for W-2s, customer data, or employee information
- ⚠Employee suddenly asking to change direct deposit
Who does this target?
Where does it happen?
What to do if you've encountered this
- 1.Stop all contact with the scammer immediately. Do not respond, do not send more money, do not try to "reason" with them.
- 2.Document everything — screenshots of conversations, phone numbers, email addresses, websites, and any transaction details.
- 3.If money was sent, contact your bank immediately. Wire and ACH reversals are measured in hours, not days.
- 4.Report the scam to the appropriate agencies:
Warning: After any scam, watch out for "recovery scammers" who promise to get your money back for an upfront fee. They are always a second scam. See our recovery scam warning guide.
Related scam patterns
Overpayment / Fake Check Scam
Someone sends you a check for more than an agreed amount and asks you to wire the difference to someone else. You deposit the check, wire the money, and a week later the check bounces — leaving you liable for the full amount.
Phishing
Scammers impersonate legitimate companies (your bank, Amazon, Microsoft, the IRS) via email to trick you into clicking a malicious link, entering login credentials on a fake site, or opening an infected attachment.
Vishing (Voice Phishing)
Phishing over the phone. Scammers call pretending to be from your bank, a government agency, or a tech company, using social engineering to trick you into revealing personal information, financial details, or transferring money.
