Business Email Compromise: The Fraud That Steals Millions Without Ransomware

A business email compromise attack shows that a company can lose millions without encryption, visible malware, or a ransom note. A convincing email, a compromised account, or a fake payment instruction can be enough for the money to leave before the security team detects the fraud.

This type of attack exploits internal trust: executives, suppliers, finance managers, procurement teams, or human resources staff. That makes it especially dangerous for organizations with fast payment processes, unclear approval chains, or sensitive communications handled by email.

The difference from other incidents is that the damage happens quietly. While ransomware stops systems, business email compromise mimics normal work routines: invoices, bank account changes, urgent instructions, and seemingly legitimate corporate conversations.

What Is Business Email Compromise?

Business email compromise, also known as BEC, is a form of fraud in which attackers manipulate or impersonate email communications to trigger money transfers, bank account changes, or the disclosure of sensitive information. 

The FBI defines it as a sophisticated scam targeting businesses and individuals who perform legitimate transfers of funds, typically through social engineering or intrusion into email accounts.

In practice, the attacker may impersonate a CEO, supplier, attorney, customer, or internal employee. The goal is not always to infect systems, but to deceive someone with the authority to approve a transaction. That is why BEC should be treated as one of the most significant cybercrimes for finance teams and senior management.

According to the FBI Internet Crime Report 2025, the IC3 received 24,768 complaints involving Business Email Compromise in 2025, with losses exceeding $3.046 billion. This makes it one of the costliest forms of business fraud reported to the FBI.

How a BEC Attack Works

A BEC attack typically begins with reconnaissance. Criminals review organizational charts, LinkedIn profiles, corporate announcements, suppliers, lookalike domains, working hours, and the names of finance decision-makers. 

Using that information, they craft a message that appears normal within the company’s workflow.

They may then register a domain that closely resembles the legitimate one, compromise a real account, or create a fake conversation. The email does not always contain malicious links or attachments: in many cases, it simply asks the recipient to confirm an invoice, change bank details, or make an urgent transfer.

The UK NCSC describes this fraud as a situation in which criminals send emails tailored to the organization, impersonate familiar contacts, and may request that a payment be sent to a different bank account. That appearance of normality is what makes the attack so effective.

The Most Common Business Email Compromise Variants

Business email compromise does not take a single form. One of the best-known variants is CEO fraud, in which the attacker impersonates an executive and requests an urgent transfer. The pressure often relies on phrases such as “I’m in a meeting,” “this is confidential,” or “it has to go out today.”

Another common variant is supplier fraud. In this case, criminals intercept or imitate communications from a real supplier and ask for bank details to be updated before the next payment. 

There is also payroll diversion, where Human Resources is deceived into changing an employee’s direct-deposit account.

In recent years, the threat has become more convincing through the use of generative AI, fake audio, and more sophisticated impersonation. A case of deepfake fraud can amplify BEC when the supposed instruction comes not only by email, but also via a phone call, video conference, or voice message.

Why BEC Steals Millions Without Using Ransomware

BEC does not need to lock files because it attacks the decision-making process directly. If an employee believes the request comes from a trusted supplier or a senior manager, they may approve the payment without triggering technical alerts. The transaction appears legitimate to the bank, the accounting system, and the company’s internal workflow.

The fraud is also often detected late. Many organizations discover the deception only when the real supplier follows up on an unpaid invoice or when the bank confirms that the funds have already been moved to other accounts. 

Unlike a visible cyberattack, business email compromise can remain hidden until the money is already gone.

That is why cybersecurity for businesses must include financial controls, human verification, and approval rules. Protecting endpoints is not enough: payment processes, suppliers, and communication channels also need to be protected.

Real-World Case: How a BEC Scam Is Built

Court cases show that BEC combines surveillance, impersonation, and money laundering. In January 2025, the U.S. Department of Justice announced charges against 12 people over a nationwide Business Email Compromise scheme that allegedly defrauded multiple victims.

According to the indictment, the defendants allegedly accessed victims’ systems to monitor communications and identify contacts, financial accounts, business practices, and potential transfers. 

They then used spoofed emails to impersonate internal staff, business partners, suppliers, or other stakeholders. This pattern matters because it shows that BEC is not just “a fake email.” 

In many cases, the attacker studies how the company operates before making a move. The more they know about payment habits, the more credible the fraudulent instruction becomes.

How to Detect Business Email Compromise Warning Signs

BEC warning signs are usually found in the context, not in a malicious file. A sudden change in bank account details, a request outside the normal process, unjustified urgency or an instruction to keep the matter confidential should trigger independent verification.

It is also important to review technical details: lookalike domains, replies sent from mobile devices, changes in email signatures, threads with unexpected recipients, forwarding rules in compromised mailboxes, or supplier communications from unverified accounts.

The key is to give the finance team permission to stop a transaction. If the internal culture penalizes delays or rewards speed over verification, the attacker has an advantage. 

Preventing BEC depends as much on technical controls as it does on clear processes.

Measures to Prevent Business Email Compromise

The first line of defense is to establish out-of-band verification. Any change to bank details, urgent request, or exceptional payment should be confirmed by phone using a previously registered contact, not the number provided in the suspicious message.

Technical controls should also be enabled. The FTC recommends using email authentication through SPF, DKIM, and DMARC to make it harder for scammers to spoof a company’s domain. Organizations should also use MFA, review forwarding rules, monitor anomalous logins, and restrict permissions in finance mailboxes.

At the same time, the company should strengthen dual approvals, verified supplier lists, limits for urgent payments, and change logs. 

These controls should be part of a cyberattack response plan that also covers financial fraud, evidence preservation, and immediate contact with the bank.

What to Do If Your Company Falls Victim to BEC

If the payment has already been sent, time is critical. The company should contact its bank immediately to request a hold, reversal, or tracing of the funds. 

The incident should then be escalated to legal, finance, security, senior management, and, where appropriate, law enforcement.

Emails, headers, access logs, transfer details, calls, messages, and any related evidence should also be preserved. The goal is to reconstruct the attack: how it started, which account was compromised, what information the attacker saw, and which controls failed.

Once the immediate financial emergency has been contained, the organization should review mailboxes, passwords, MFA, forwarding rules, lookalike domains, and payment processes. 

Post-incident learning is part of recovery: a BEC case should end with operational improvements, not just a technical investigation.

Conclusion

Business email compromise is dangerous because it does not need to look like a cyberattack. It can arrive as a normal request, from a familiar account, at the exact moment the company expects to make a payment. That is how it steals millions without ransomware, without malware, and without technical noise.

Protection requires a combination of technology, processes, and culture: MFA, SPF, DKIM, DMARC, out-of-band verification, dual approval, training, and rapid response capabilities. 

A company that verifies before paying dramatically reduces the attacker’s room to maneuver.

At HelpRansomware, we help organizations prepare for cybersecurity incidents, digital fraud, and attack-driven crises. Against BEC, the best defense is to anticipate the deception before the money leaves the account.

FAQ