Business email compromise (BEC) is fraud carried out through email or messaging: an attacker impersonates an executive, supplier, or employee to trick someone into sending money or sensitive data.

Why it’s so costly

The FBI’s Internet Crime Complaint Center recorded about US$2.77 billion in reported BEC losses in 2024, among the largest of any cybercrime category. Reported figures understate reality, because many victims never report.

Common versions

– Executive impersonation: “I’m in a meeting. Buy gift cards” or “Wire this payment today.”

– Vendor invoice fraud: a supplier’s account is compromised, or spoofed, and a “new bank account” is provided

– Payroll diversion: a fake request to change an employee’s direct deposit

– Real estate and legal payments: fraudulent wiring instructions at closing

– Hybrid attacks: a convincing email followed by a phone call, sometimes with a cloned voice

– Data theft: requests for tax forms, employee data, or customer lists

Why technology alone doesn’t stop it

Many BEC emails contain no malware and no suspicious links. They come from a real but compromised account, or a look-alike domain, and use urgency and authority.

Defenses that work

1. Call-back verification for any change to payment details, using a phone number you already have

2. Dual approval for payments above a threshold

3. MFA and Conditional Access to prevent account takeover

4. Email authentication (SPF, DKIM, DMARC) to block spoofing of your domain

5. Impersonation protection and external-sender warnings in your email security tool

6. Mailbox rule monitoring: attackers often create hidden forwarding rules

7. Staff training with realistic examples, especially for finance and executive assistants

8. A clear reporting channel and a no-blame culture

If it happens

Contact your bank immediately to attempt a recall, notify your insurer, report to local police and the Canadian Anti-Fraud Centre, and have your IT provider investigate the compromised account.

Sources: FBI IC3 Internet Crime Report (2024 figures).

DBR Soft can harden your email and build payment verification procedures. Contact us for more information.