What is Business email compromise (BEC)?
Also known as: CEO fraud, invoice fraud
Business email compromise (BEC) is fraud in which an attacker writes as a CEO, supplier or partner and asks for a payment or a change of bank details. Often there is no malicious link at all, just a convincing request.
The FBI Internet Crime Complaint Center (IC3) 2023 report put reported BEC losses at roughly US$2.9 billion for that year alone. The main defence is process: every payment or change of bank details is verified through a second channel.
How to spot it
- "New bank details" from a supplier
- The CEO is "in a meeting" and needs an urgent transfer
- A request to keep it confidential
What to do
- Confirm any change of bank details by calling a known number
- Require two people to approve a transfer
- Report unusual requests to finance and IT
Related courses
Terms on this topic
More topics
Start with your team's risk baseline
15-30 employees, one phishing simulation and a one-page report for management. No annual commitment.