Business email compromise
BECAlso called email compromise fraud, CEO fraud
Business email compromise is a fraud in which criminals hijack or impersonate a business email account to trick staff, suppliers or customers into sending money or sensitive data. Typical schemes include fake supplier invoices, changed bank details and urgent payment requests that appear to come from a senior executive.
How it works
Fraudsters gain access to a real mailbox through phishing or stolen passwords, or register a lookalike domain that differs from the genuine one by a single character. They study the email traffic to learn who approves payments, which suppliers are paid and when. At the right moment they send a convincing message asking for an urgent transfer or for future payments to go to a new account they control.
The payment is usually a wire or faster payment to a mule account, and the funds are moved on quickly, often abroad. Banks spot BEC through red flags such as last-minute changes to payee details, first payments to new beneficiaries and requests that bypass normal approval. Firms that detect a suspected case recall the payment, contact the receiving bank and file a suspicious activity report.
The rules
Defines email compromise fraud, sets out red flags and asks institutions to use the key term "BEC FRAUD" or "EAC FRAUD" when filing suspicious activity reports.
US financial institutions with suspicious activity reporting dutiesRequires sending and receiving firms to share the cost of reimbursing authorised push payment fraud victims, covering consumers, micro-enterprises and charities, including those tricked by email impersonation.
Payment service providers sending and receiving Faster Payments and CHAPS paymentsCommon questions
Is business email compromise the same as phishing?
No. Phishing is one way fraudsters get into a mailbox. Business email compromise is the wider fraud that follows, where the hijacked or spoofed account is used to request payments or data.
Who is targeted by BEC?
Any organisation that pays invoices by bank transfer, including companies, law firms, property buyers, charities and public bodies. Finance teams and staff who can change supplier bank details are the main targets.
How do firms prevent BEC?
Firms verify any change to payee details by calling a known number, require dual approval for large or first-time payments, use multi-factor authentication on email and train staff to treat urgent payment requests with care.
