Business Email Compromise (BEC) is a growing problem for businesses and their employees. In 2020, the FBI's Internet Crime Complaint Center received almost 20,000 complaints of BEC — with losses of more than $1.8 billion.1
What BEC Looks Like
In a BEC scam, a fraudster sends an email — from an address that appears to be real — to someone in the target organization. In the email, the scammer directs the recipient to send a large payment, usually via wire transfer, to the fraudster's account.
How BEC works
BEC is effective because it's usually part of a long-term plan. Once scammers identify a target organization, they typically:
- Penetrate the company email system.
- Study the operations and company hierarchy.
- Learn about company procedures.
- Familiarize themselves with travel plans of company executives.
How to Stop BEC
Educate your staff. Fraud techniques are continually evolving, so security awareness training needs to be ongoing. Review existing procedures. Consider new policies for approving unexpected payments or wire transfers, such as requiring confirmation for the transaction through some means other than email.
Use a code word. Establish a code word or security question that must be answered before any transfer can take place.
Be skeptical. Train employees to be suspicious of any unplanned transfers of money, wire transfers that must happen immediately, or secret transactions. Legitimate business transactions can always wait for appropriate verification.
If you suspect BEC:
- Immediately contact your financial institution.
- File a report with the FBI's Internet Crime Complaint Center (IC3).2
- Your bank and the FBI may be able to recover the stolen funds if you notify them immediately.
Important disclosure information
This content is general in nature and does not constitute legal, tax, accounting, financial or investment advice. You are encouraged to consult with competent legal, tax, accounting, financial or investment professionals based on your specific circumstances. We do not make any warranties as to accuracy or completeness of this information, do not endorse any third-party companies, products, or services described here, and take no liability for your use of this information.
- FBI Internet Crime Complaint Center, "Internet Crime Report 2020," accessed August 20, 2021. Back
- https://www.ic3.gov/, accessed August 20, 2021. Back