Digital Lexicon Hub

A fraud in which criminals impersonate or take over a trusted email account to trick staff into sending money or sensitive data.

BEC targets payment processes rather than technology, and the FBI counted about $55.5 billion in exposed losses worldwide from October 2013 to December 2023, so finance controls matter as much as email filters.

A supplier's mailbox is compromised and sends a genuine-looking invoice with new bank details. The buyer's policy requires a phone call to a known number for any bank change, which exposes the fraud before a $48,000 transfer.

Many BEC emails come from real compromised accounts or lookalike domains, so DMARC and filters alone do not stop them. Training fades under time pressure, and recovering funds depends on reporting to the bank within days.

Attackers gain access through credential Phishing or malware, or register lookalike domains and spoof display names, then study invoice threads and payment timing. Common variants are fake vendor invoices, executive requests for urgent wires or gift cards, and payroll diversion. Controls include DMARC enforcement, multi-factor authentication, monitoring of mailbox forwarding rules, external sender tags, and out-of-band verification of any payment or bank detail change.