The Complete Guide to Business Email Compromise (BEC) Attacks in 2026
BEC attacks are a major threat, using social engineering and email spoofing to trick employees into unauthorized transactions or disclosing sensitive data.
Josh Bass CPO · · 13 min read
Business Email Compromise, or BEC, is a form of targeted fraud in which an attacker exploits trusted business communications to persuade someone to transfer money, change payment details, disclose sensitive information or take another unauthorised action. The attacker may impersonate an executive or supplier, register a convincing lookalike domain, or gain access to a legitimate mailbox and communicate from the real account. The FBI describes BEC as a sophisticated fraud targeting organisations and individuals involved in legitimate transfers of funds.
BEC is financially significant because the malicious action often looks like normal work. There may be no malware to execute, suspicious attachment to scan or obviously fraudulent link to block. In many cases, the objective is simply to make a finance employee, executive assistant, payroll administrator or supplier believe that an unusual request is legitimate.
The cost remains substantial. The FBI's Internet Crime Complaint Center recorded 24,768 BEC complaints and $3.047 billion in reported losses in 2025, compared with $2.770 billion in reported BEC losses in 2024. These are complaint-based figures—not an estimate of every BEC incident that occurred—so they are best understood as a measure of reported harm.
Meanwhile, artificial intelligence is making impersonation cheaper and easier to scale. The FBI warns that criminals can use generative AI to produce convincing text, translations, images, video and voice material, reducing some of the grammatical and stylistic errors that once exposed scams. In 2025, businesses reported more than $30 million in losses from BEC complaints carrying an AI nexus.
For defenders, that changes the question. It is no longer enough to ask whether an email looks legitimate. Organisations increasingly need to determine whether the identity, request, context and business behaviour behind a message make sense together.
What is Business Email Compromise?
Business Email Compromise is a targeted social-engineering and fraud technique in which criminals manipulate trusted business identities or communications to induce an unauthorised action. The desired outcome is commonly money, but BEC can also target payroll information, tax documents, personal data, credentials or other sensitive business information. The FBI recognises both spoofing and compromise of legitimate accounts as common BEC mechanisms.
The defining feature is business context. A generic credential-phishing campaign might send the same Microsoft 365 password-reset lure to thousands of recipients. A BEC operation is more likely to exploit who approves invoices, which supplier normally gets paid on Friday, which executive is travelling, who manages payroll or which employee can change bank details.
This is why BEC may have almost no technically malicious content. A message such as “Are you at your desk?” can be the opening move. Microsoft found these generic conversational approaches dominated BEC initial contact throughout the first half of 2026. The explicit fraudulent instruction can arrive only after the employee replies.
BEC vs phishing vs spear phishing vs Vendor Email Compromise
BEC and spear phishing overlap, but they are not synonymous. Spear phishing describes targeting; BEC describes a fraud model built around business identity and trusted workflows. VEC is best treated as an important subset of BEC involving the external side of a trusted commercial relationship.
The FBI and Microsoft both describe BEC as relying on impersonation and trusted identities, while StrongestLayer's VEC research details the particular risk created when a genuine supplier account is compromised.
How a Business Email Compromise attack works
A useful way to understand BEC is as a lifecycle rather than a single email.
flowchart LR
A[Reconnaissance] --> B[Identity or account access]
B --> C[Impersonation or trusted conversation]
C --> D[Relationship building]
D --> E[Fraudulent business request]
E --> F[Payment or data action]
F --> G[Concealment and cash-out]Reconnaissance
Attackers first identify the people, relationships and processes that make fraud possible. Public websites, LinkedIn profiles, supplier pages, press releases, breached credentials and prior mailbox access can reveal executives, finance staff, reporting lines and vendor relationships. MITRE maps this type of organisational reconnaissance as a precursor to impersonation activity.
Identity impersonation or account compromise
The attacker then needs a trusted identity. That may involve display-name impersonation, a lookalike domain or a compromised Microsoft 365 or Google Workspace account. A legitimate compromised account is especially valuable because its normal domain, authentication and correspondence history remain intact.
Context gathering
If attackers gain mailbox access, they can study real conversations before acting. Microsoft's 2026 EvilTokens research documented AI functionality designed to analyse compromised mailbox activity and support target-specific phishing, illustrating how account compromise can become reconnaissance for subsequent fraud.
Conversation
The attacker may begin with a low-risk message rather than an immediate wire request. Microsoft's 2026 BEC data show that generic outreach overwhelmingly exceeded direct financial requests as the initial contact pattern.
Fraudulent request
Once the target is engaged, the request becomes operational: update bank details, pay an invoice, redirect payroll, purchase gift cards, release tax records or transfer confidential information.
Cash-out and concealment
If money is transferred, attackers may rapidly move it between accounts or payment channels. If a mailbox is compromised, they may create inbox rules or other persistence mechanisms to hide replies and delay discovery. Microsoft's EvilTokens investigation specifically observed malicious inbox rules and token-based persistence after account compromise.
The main types of BEC attacks
Executive impersonation and CEO fraud
The attacker poses as a CEO, CFO, president or other senior leader and invokes authority, confidentiality or urgency. The goal might be a wire transfer, invoice approval, acquisition-related payment or release of sensitive information.
In September 2026, Microsoft documented an AI-assisted campaign in which attackers impersonated senior executives and attempted to persuade accounts-payable teams to process ACH payments of nearly $50,000. The emails combined executive identities, fabricated invoices and supporting email conversations.
Vendor Email Compromise
VEC exploits supplier trust. The attacker may spoof the vendor, but the harder version begins after the vendor's real account is compromised. The criminal can then observe invoice conversations and insert changed bank details at a plausible point in the relationship.
The key anomaly may therefore be what the trusted sender is requesting, rather than who sent the email. StrongestLayer's existing VEC guide explores this model in detail and should be internally linked from this section.
Invoice and payment diversion
Attackers intercept or imitate legitimate billing activity and replace the payment destination. Fraudulent bank-detail changes are particularly effective because the invoice itself may be genuine.
Payroll diversion
An attacker impersonates an employee or executive and asks payroll to change direct-deposit information. Microsoft observed payroll-update requests as a recurring BEC category in 2026 and documented a high-volume June campaign involving both ageing-report theft and payroll-diversion lures.
Account takeover BEC
Rather than impersonating a trusted person, the attacker controls the trusted person's real account. This can support thread hijacking, fraudulent invoice changes, internal reconnaissance and secondary attacks against customers or suppliers.
Data and tax-document theft
Not all BEC ends in an immediate transfer. PII, payroll files, W-2 information, customer records or financial documents may be valuable for subsequent fraud. The FBI explicitly notes that BEC variations can involve requests for personally identifiable information.
How AI is changing BEC
AI does not replace the fundamental psychology of BEC; it reduces the work required to execute it.
The FBI says generative systems can help criminals produce believable messages at greater volume, translate them more naturally and remove errors that might otherwise warn a recipient. Synthetic images, video and cloned voices can extend impersonation beyond the inbox.
The 2025 IC3 report puts measurable loss behind that concern. It recorded 22,364 complaints with an AI-related descriptor and more than $893 million in adjusted losses across AI-related complaints; businesses attributed more than $30 million specifically to AI-related BEC.
AI also enables contextualisation. Microsoft's EvilTokens investigation found AI capabilities intended to analyse compromised mailbox data and engineer target-specific emails. In other words, the attacker does not merely ask a language model to “write a professional invoice email”. With access to real corporate communication, AI can help process context that previously required significant manual effort.
Finally, email may become only one element of the persuasion chain. The FBI has documented BEC schemes involving virtual meetings and deepfake audio, and its broader generative-AI warning describes criminals using synthetic video and voice in financial fraud.
Three modern BEC scenarios
These scenarios are composites based on documented attack patterns, not StrongestLayer customer incidents.
Scenario one: the supplier bank-account change
A manufacturer regularly pays a logistics provider. An attacker gains access to an employee mailbox at the logistics company and waits while legitimate invoices and shipment messages pass through it.
When a large invoice is due, the attacker replies inside the existing thread:
“We recently migrated our settlement account. Please use the attached remittance details for this week's payment.”
The sender address is real. SPF, DKIM and DMARC can all succeed because the message genuinely originates from the compromised supplier environment. The invoice number, employee signature and tone match previous conversations.
The control that matters most at the decisive moment is not another glance at the email address. It is an independent verification process for payment-detail changes, using a known phone number or approved vendor-management channel rather than contact information supplied in the message. The FBI recommends secondary-channel verification for account-information changes for precisely this reason.
Scenario two: AI-assisted executive invoice fraud
An accounts-payable employee receives a message appearing to come from the CEO approving a vendor invoice. It includes a plausible forwarded conversation, company details and an attached invoice. Nothing is misspelled, and the tone resembles normal executive communication.
This resembles the campaign Microsoft reported in September 2026: attackers sent more than a million emails, impersonated executives and vendors, and sought ACH payments of nearly $50,000 while using several signals consistent with generative-AI-assisted template creation.
A strong defence combines executive-impersonation controls, analysis of the request itself and a finance rule requiring independent approval for unusual or newly introduced payment destinations.
Scenario three: compromised mailbox to payroll diversion
An employee first encounters credential phishing that steals a session or token rather than simply a password. The attacker gains mailbox access, studies the organisation and identifies payroll contacts. They then submit a plausible direct-deposit change using the genuine employee identity.
This pattern reflects the broader evolution Microsoft documented in EvilTokens and its 2026 BEC telemetry: compromised inboxes can provide both access and intelligence, while payroll changes remain an established BEC monetisation method.
Phishing-resistant authentication, session/token monitoring, suspicious inbox-rule detection and payroll verification are all relevant because no single email control covers the entire chain.
Why traditional email controls can miss modern BEC
Traditional email protections remain valuable. Secure email gateways can block known malicious URLs, malware, spoofing and reputation-based threats. SPF, DKIM and DMARC help organisations establish whether mail is authorised for a sending domain. MFA can make stolen passwords less useful.
The limitation is scope.
Authentication answers where a message came from—not whether its business request is honest. A lookalike domain can be properly configured with its own authentication records. A genuinely compromised vendor account can send authenticated malicious mail. StrongestLayer's current product documentation makes the same architectural distinction: authentication can establish origin, while its TRACE system is designed to reason over message intent and organisational context.
BEC can also be plain text. Microsoft's 2026 datasets show that generic conversational messages such as “Are you at your desk?” represented most initial BEC contacts. There may be no link, file or malware sample to classify at that stage.
That does not make older controls obsolete. It means BEC requires additional signals: identity, behaviour, relationship history, business context, request type and verification workflow.
How to prevent BEC: a five-layer defence strategy
No single control should be positioned as “the BEC solution”. A resilient programme makes the attack succeed at several independent checkpoints.
Layer one: email, behavioural and intent detection
Email security should inspect more than malware and reputation. Modern systems can analyse sender behaviour, relationship history, request type, linguistic context and whether the action being requested differs from established patterns.
StrongestLayer describes TRACE as a three-model reasoning architecture that evaluates a case for legitimacy, a case against the message and sender/provenance context before producing a verdict and reasoning trace. Its platform documentation says it compares messages with organisational history such as vendor relationships and normal approval behaviour.
That is a documented product architecture, not a guarantee that every BEC attack will be detected.
Layer two: email authentication and domain protection
Configure SPF, DKIM and DMARC correctly and enforce a suitable DMARC policy once legitimate senders are understood. These controls reduce exact-domain spoofing and improve visibility into unauthorised use of a domain.
They should not be confused with semantic fraud detection. A criminal using a separate lookalike domain or a legitimate compromised account can still send authenticated mail.
Layer three: identity and account security
Use MFA, preferably phishing-resistant methods where appropriate, monitor suspicious sign-ins and sessions, review unexpected forwarding or inbox rules, restrict excessive privileges and investigate unusual OAuth or delegated-access activity.
The FBI recommends MFA as a core BEC control. Microsoft's 2026 EvilTokens research demonstrates why defenders must also think beyond passwords: token theft, malicious rules and persistent account access can support subsequent BEC operations.
Layer four: financial and workflow verification
This is one of the strongest defences because it operates outside the attacker's email narrative.
Create defined controls for:
- new bank accounts;
- changes to supplier payment details;
- exceptional wire transfers;
- payroll changes;
- large gift-card purchases;
- requests for tax or employee data.
Require confirmation using a trusted channel already on record—not a telephone number or link introduced by the suspicious message. The FBI explicitly recommends verifying payment and account changes through a secondary channel.
Layer five: people, reporting and response
Employees should know which business actions require verification rather than being expected to memorise every new phishing trick. Finance, payroll, executive support, procurement and vendor-management teams deserve role-specific training because attackers target the authority and workflows those roles control.
StrongestLayer's Inbox Advisor is positioned as an Outlook and Gmail tool that provides a plain-language assessment of sender identity, organisational history and legitimacy when users question a message. Whether using that product or another mechanism, the design goal should be fast reporting and useful context—not relying on employees as the final detection engine.
BEC protection checklist
How StrongestLayer fits into layered BEC protection
StrongestLayer should be presented as one technical layer within a broader BEC programme, not as a replacement for financial controls, MFA or email authentication.
The company's current platform documentation says TRACE analyses what a message is asking for, how it arrived and whether the activity fits the organisation's established context. It uses separate defence, prosecution and provenance reasoning engines and produces an explainable verdict.
Inbox Advisor extends that analysis into Outlook and Gmail so users can inspect suspicious messages and receive a plain-language assessment.
For organisations evaluating BEC protection, the practical test is not whether a vendor has “AI” in its product name. Test whether it can identify your actual high-risk workflows: vendor-bank changes, executive impersonation, payroll diversion, thread hijacking and messages from compromised accounts—and whether analysts can understand why it reached each verdict.
What to do after a BEC attack
When money may have been transferred, time is critical. The FBI recommends immediately contacting the financial institution, requesting a recall where possible and filing an IC3 complaint as soon as possible.
Use this incident-response sequence:
- Contact the bank or payment provider immediately. Request a freeze, recall or fraud escalation.
- Report the incident through IC3 or the appropriate national law-enforcement channel.
- Secure affected accounts. Reset credentials, revoke suspicious sessions and tokens, review MFA settings and sign out unknown devices.
- Inspect mailbox rules and delegated access. Remove unauthorised forwarding,
SendAsor inbox-rule changes. - Preserve evidence. Retain original emails, headers, transaction records, timestamps, account details and relevant logs.
- Search for related messages. Determine whether the same attacker targeted additional staff, customers or suppliers.
- Notify affected partners. A compromised business account can be used to attack the organisation's external relationships.
- Review the failed control. Was the weakness identity, detection, payment approval, vendor verification or escalation?
- Update controls and training from the incident. The objective is not simply to restore the mailbox but to remove the process gap that made the fraud possible.
Australia's national cyber-security guidance similarly recommends changing credentials, reviewing recovery information, signing out active devices, enabling MFA, removing unfamiliar mailbox rules and checking connected services after BEC account compromise.
The future of Business Email Compromise
BEC is likely to become less dependent on email alone.
AI-generated text makes personalised outreach cheaper. Voice and video synthesis allow attackers to reinforce an email request through another channel. Compromised SaaS accounts and stolen session tokens give criminals access to authentic communications and internal context. Microsoft has also observed rising social-engineering activity in Teams, although its Q2 2026 data indicated that financial and executive impersonation remained comparatively uncommon in Teams during that period.
The second trend is industrialisation. Access brokers, phishing-as-a-service platforms and automated reconnaissance reduce the amount of specialist work required to operate BEC campaigns. Microsoft's 2025 and 2026 research shows criminal ecosystems increasingly combining stolen accounts, automation and AI-assisted personalisation.
The third trend is more important for defenders: identity alone will not be enough to establish trust. Organisations need to validate the business action as well as the sender. An authenticated supplier asking for an unprecedented remittance change is still a risk event. A real executive account asking for an unusual payment may still be compromised.
The future of BEC defence is therefore not a contest between one email filter and one attacker. It is a system of independent controls designed so that compromise of one layer does not automatically result in financial loss.
Final Thoughts
BEC succeeds when an attacker makes an abnormal action feel normal.
The modern attack may come from a newly registered lookalike domain, a CEO impersonation, a real supplier mailbox or an account compromised weeks earlier. AI can make the language more convincing and the reconnaissance faster, but the underlying objective remains familiar: exploit trust at the moment someone can move money or information.
The most effective response is therefore layered. Authenticate email. Protect identities. Analyse behaviour and intent. Verify high-risk financial changes independently. Give employees a fast way to question suspicious requests. And have a response plan ready before a transfer occurs.
FAQ
What is Business Email Compromise?
Business Email Compromise is targeted fraud that exploits trusted business identities or email accounts to persuade someone to transfer money, change payment details, disclose information or perform another unauthorised action. Attackers may impersonate executives or vendors, use lookalike domains or compromise legitimate accounts.
How does a BEC attack work?
A typical BEC attack combines reconnaissance, impersonation or account compromise, contextual communication and a fraudulent request. Attackers often build trust before asking for money: Microsoft's 2026 telemetry found that generic outreach represented the majority of initial BEC messages.
What is the difference between BEC and phishing?
Phishing is the wider category of deceptive messages designed to trigger harmful actions. BEC is a targeted form of business fraud that specifically exploits organisational trust, identities and workflows. It may contain no malware or credential-stealing link.
What is Vendor Email Compromise?
Vendor Email Compromise is BEC involving a supplier or business partner. The attacker may impersonate that vendor or compromise its real account, then redirect invoices, alter bank information or abuse legitimate email threads. This can make sender-based checks less useful because the account itself may be authentic.
Can DMARC prevent BEC?
DMARC can significantly reduce unauthorised spoofing of a protected domain and should form part of an email-security programme. It cannot determine whether the request inside an authenticated message is legitimate, and it does not prevent an attacker from using a compromised legitimate account or a separate lookalike domain.
Does MFA stop Business Email Compromise?
MFA reduces account-takeover risk and is recommended by the FBI, but BEC can also occur through spoofing, lookalike domains, compromised external suppliers or social engineering that never requires access to the target's account.
How is AI used in BEC?
Generative AI can produce professional text, translation, synthetic voice and video, and can help scale personalisation. The FBI recorded more than $30 million in reported losses from AI-related BEC complaints in 2025, while Microsoft has documented AI-assisted executive impersonation and tools that analyse compromised mailbox content.
Why can BEC emails be difficult to detect?
Some contain no malware, suspicious attachment or known malicious URL. Others originate from legitimate compromised accounts. Microsoft's 2026 telemetry found that most initial BEC messages were generic conversational outreach rather than explicit financial demands.
What should businesses do to prevent BEC?
Use layered controls: email threat detection, SPF/DKIM/DMARC, strong identity protection and MFA, independent verification of payment changes, dual approvals for high-risk transactions, role-specific awareness and a tested incident-response plan. The FBI particularly recommends secondary-channel verification for changes in payment or account details.
What should I do immediately after a BEC payment?
Contact the financial institution immediately and request a recall or freeze, then report the fraud to IC3 or the relevant law-enforcement authority. Preserve the original messages and transaction records, secure affected accounts and investigate whether additional people or suppliers were targeted.
Who is most often targeted by BEC?
Roles able to authorise money, modify payment details or release valuable information are particularly attractive: finance and accounts payable, executives and executive assistants, payroll and HR, procurement and vendor-management teams, legal staff and IT administrators. Cisco and the FBI describe these authority- and access-driven targeting patterns.
What should organisations look for in a BEC protection solution?
Evaluate whether the product can analyse sender identity, behaviour and the requested business action; detect threats without relying exclusively on known malicious artefacts; explain its decisions; integrate with your existing mail environment; support investigation and remediation; and demonstrate results against your own high-risk mail flows. Technology should complement—not replace—MFA, authentication and payment-verification controls.