[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is Business Email Compromise (BEC)? And How To Prevent It](/blog/business-email-compromise) Publish date June 24, 2025 {x} minute read # What is Business Email Compromise (BEC)? And How To Prevent It [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Catherine Chipeta](/team/catherine-chipeta) Cybersecurity Writer Catherine's work has influenced leaders in technology, SaaS, government, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Free resource ### [Download now](#) [Business email compromise (BEC)](https://www.upguard.com/glossary/business-email-compromise) occurs when cybercriminals scam organizations by compromising sensitive data through email accounts for financial gain. [FBI research shows that](https://www.ic3.gov/Media/PDF/AnnualReport/2021_IC3Report.pdf) BEC is currently the most costly digital crime, far surpassing [ransomware](https://www.upguard.com/blog/ransomware) to account for US$49.2 million in victim losses in 2021. BEC is also known as email account compromise (EAC) or 'man-in-the-email' scamming. ## How Does Business Email Compromise Work? Cybercriminals can use several techniques to carry out BEC scams, including directly hacking an email account and social engineering techniques.  Two common methods of BEC include: ### Keylogging **‍**Cybercriminals [use keyloggers to gain unauthorized access to legitimate email accounts](https://www.upguard.com/blog/what-is-a-keylogger). This [type of spyware](https://www.upguard.com/blog/spyware) can monitor and record a user's password by logging keystrokes, reading clipboard data, or taking screenshots from the user's device. For example: 1. A cybercriminal [sends a phishing email](https://www.upguard.com/blog/phishing) containing the keylogger spyware to an unsuspecting employee.  2. The employee mistakes the phishing scam as a legitimate download and unknowingly installs the keylogger [malware](https://www.upguard.com/blog/malware) onto their device.  3. The cybercriminal uses the keylogger to record the user's email password. 4. The cybercriminal can now gain access to the employee's email account and carries out a [cyber attack](https://www.upguard.com/blog/cyber-attack) directly via the compromised account. [*Learn more about keylogging.*](https://www.upguard.com/blog/what-is-a-keylogger) ### Spear Phishing A cybercriminal uses a spoofed email to obtain confidential information from an employee or organization. Cybercriminals often [undertake spear phishing attacks](https://www.upguard.com/blog/spear-phishing) to compromise [personally identifiable information (PII)](https://www.upguard.com/blog/personally-identifiable-information-pii) and [protected health information (PHI)](https://www.upguard.com/blog/protected-health-information-phi). For example: 1. A cybercriminal [impersonates a business email account](https://www.upguard.com/blog/impersonation-attack) through domain spoofing, e.g., john.smith\@piedpiper.com (the email address of John Smith, a legitimate employee at Pied Piper) → john.smith\@peidpiper.com (the cybercriminal's spoofed email address). 2. The cybercriminal uses the spoofed email address or hacked account to send an email to another employee from the same organization requesting confidential information.  3. The employee mistakes the misspelled email address for John Smith's email address and unknowingly reveals sensitive company data to the cybercriminal in response to the email. 4) The cybercriminal uses this breached data to carry out a cyber attack.  [*Learn more about spear phishing attacks.*](https://www.upguard.com/blog/spear-phishing) The exact information the cybercriminal attempts to obtain using these techniques depends on the type of BEC scam they are conducting. ## Types of Business Email Compromise There are 5 main types of BEC scams, as listed below. **1. The Bogus Invoice Scheme: **A cybercriminal impersonates [an organization's vendor or supplier](https://www.upguard.com/blog/third-party-vendor), usually through a [spoofed email account](https://www.upguard.com/blog/email-spoofing). The scammer sends a fraudulent invoice to the organization requesting payment to an unfamiliar bank account.  **2. CEO Fraud: **More generally known as 'Executive Fraud,' this scam occurs when a cybercriminal hacks a CEO or executive-level employee's email account. Posing as the employee, the hacker then requests payment from the finance department to an unfamiliar bank account.  **3. Account Compromise:** A cybercriminal hacks an employee's email account and sends fraudulent invoices to vendors from its address book, requesting payments to an unfamiliar bank account.  **4. Attorney Impersonation:** A cybercriminal poses as a lawyer or other legal professional and contacts an employee under the guise of an urgent matter. The cybercriminal informs the employee to act quickly and discreetly, pressuring the victim to transfer funds over to an unfamiliar bank account to resolve the issue immediately.**‍** **5. Data Theft:** A cybercriminal hacks an employee's email account in a relevant department (such as HR) to request the personally identifiable information (PII) of other staff members, providing intelligence for a more damaging attack.  BEC scammers rely predominantly on [human error vulnerabilities](https://www.upguard.com/blog/vulnerability) to achieve their malicious objectives. Organizations should pair employee education with additional security measures to defend against BEC effectively.  ## How to Defend Against Business Email Compromise Attacks The following defense strategies can help reduce the occurrence of BEC attacks in your organization. ### Educate Staff Security awareness training programs are crucial to ensuring employees can identify BEC attempts [before a data breach occurs](https://www.upguard.com/blog/prevent-data-breaches). Organizations must train employees to scrutinize all emails requesting [sensitive data](https://www.upguard.com/blog/sensitive-data), whether internal or external. When in doubt, employees should always seek advice before responding to suspicious emails. Below are common signs of a potential BEC attempt that employees should consider when receiving email requests for sensitive data. * **Unusual email requests from colleagues, including CEOs and high-level executives. **When scammers use spear phishing tactics, they will often make requests that don't make sense, e.g., a CEO asking for an employee's individual payroll details.  - **Incorrect use of language. **E.g., use of broken English, spelling and grammatical issues, inconsistent tone in language, such as lapsing between casual and formal language.  * **Inconsistencies in font type, font size, or email format. **E.g., the email body text uses two different font sizes. - **Typos in the sender's email address or different formatting. **E.g., → , → [johnsmith@piedpiper.com](mailto:john.smith@peidpiper.com). * **Requests that don't follow usual protocol.** Organizations follow specific processes for payments, regardless of their urgency. An email requesting an immediate wire transfer that doesn't follow these processes is likely cause for concern. - **Requests to keep communication private.** Scammers often ask recipients to keep their email interactions between the two parties to minimize outside scrutiny and suspicion.  ### Implement Multi-factor Authentication (MFA) Multi-factor authentication (MFA) adds an additional layer of [data protection](https://www.upguard.com/blog/data-security) to employees' devices and accounts. MFA ensures users adequately identify themselves before accessing their email accounts and other apps that store sensitive information. This authentication method often uses a combination of a password/pin with additional verification requirements, such as biometrics. If a cybercriminal compromises the first line of authentication, they are less likely to bypass the other authentication methods. ### Prevent Email Typosquatting [Typosquatting](https://www.upguard.com/blog/typosquatting) is a hacking technique that takes advantage of users misspelling an organization's domain name. If a scammer successfully hijacks a misspelled URL, they can use the typosquatted domain in emails to pose as a sender from the victim organization. Organizations can help prevent this entry point for BEC scammers by registering domains that look similar to their own or are likely to be mistaken for theirs. For example, piedpiper.com could register peidpiper.com, p1edpiper.com, pied-piper.com, etc. [*Learn more about typosquatting. *](https://www.upguard.com/blog/typosquatting) ### Implement Email Verification Email verification methods can help to filter, block, and report suspicious emails, preventing BEC before it even reaches an employee's inbox. Common email verification methods include: * [**Sender Policy Framework (SPF) Filtering**](https://www.upguard.com/blog/spf)**:** Ensures incoming emails are coming from the domain they claim to be. - DomainKeys Identified Mail (DKIM):  Adds encrypted signatures to validate all outgoing emails and verify incoming emails. * [**Domain-based Message Authentication, Reporting & Conformance (DMARC)**](https://www.upguard.com/blog/dmarc): Leverages SPF filtering and DMARC and provides reporting and guidance surrounding what action to take with unauthenticated emails, e.g., send to the spam folder, reject entirely.  [*Learn more about SPF Filtering, DKIM, and DMARC.*](https://www.upguard.com/blog/email-security) [*Assess your organization's email security against our checklist.*](https://www.upguard.com/blog/the-email-security-checklist) [*Implement additional email security best practices.*](https://www.upguard.com/blog/email-security) ### Develop Effective Security Controls Robust cybersecurity controls make it more difficult for cybercriminals to compromise an organization's systems. Organizations must fulfill their regulatory requirements, such as [PCI DSS](https://www.upguard.com/glossary/pci-dss), [HIPAA](https://www.upguard.com/blog/hipaa-privacy-rule), and [FISMA](https://www.upguard.com/blog/fisma). Complying with recognized security frameworks, including the [NIST Cybersecurity Framework](https://www.upguard.com/blog/nist-cybersecurity-framework), [NIST 800-53](https://www.upguard.com/blog/nist-sp-800-53), and [ISO 27000 series](https://www.upguard.com/blog/iso-third-party-risk-management-requirements), also helps organizations ensure their [cybersecurity](https://www.upguard.com/blog/cyber-security) is up to international standards. ### Limit Public Display of Personal Information Cybercriminals can leverage [open source intelligence tactics](https://www.upguard.com/blog/open-source-intelligence) to uncover vital information for [social engineering](https://www.upguard.com/blog/social-engineering) schemes in future attacks. For example, they can easily find employee names, job titles, and contact details on social media sites like LinkedIn. Employees should be mindful of their social media privacy settings and avoid sharing excessive [publicly identifiable information (PII)](https://www.upguard.com/blog/personally-identifiable-information-pii) online. ## How to Recover From a BEC Scam If your organization has fallen victim to BEC, time is of the essence. The FBI outlines the following steps: Step 1. Contact your financial institution immediately and ask them to contact the financial institution provided by the scammer. Step 2. Report the crime at your [local FBI field office](https://www.fbi.gov/contact-us/field-offices). Step 3. Lodge a complaint with the [FBI's Internet Crime Complaint Center (IC3)](https://www.ic3.gov/default.aspx). Countries outside of the US should follow Step 1. as above, then contact their local authorities for details on next steps.  ### Continue Learning about Cyber Threats * [How Do You Get Infected by Ransomware?](https://www.upguard.com/blog/how-do-you-get-infected-by-ransomware) * [Best Practices to Prevent Ransomware Attacks ](https://www.upguard.com/blog/best-practices-to-prevent-ransomware-attacks) * [What is Cyber Threat Intelligence?](https://www.upguard.com/blog/what-is-cyber-threat-intelligence) * [What is Cyber Risk Quantification?](https://www.upguard.com/blog/what-is-cyber-risk-quantification) * [What You Need to Know About the Apache Log4j Vulnerability](https://www.upguard.com/blog/apache-log4j-vulnerability) * [What is Threat Intelligence?](https://www.upguard.com/blog/threat-intelligence) * [What is Threat Modelling?](https://www.upguard.com/blog/what-is-threat-modelling) * [What is Netwalker Ransomware?](https://www.upguard.com/blog/what-is-netwalker-ransomware) * [What is Egregor Ransomware? ](https://www.upguard.com/blog/what-is-egregor-ransomware) * [What is a Cyber Threat?](https://www.upguard.com/blog/cyber-threat) * [What is Cyber Resilience?](https://www.upguard.com/blog/cyber-resilience) * [What Is an Insider Threat? ](https://www.upguard.com/blog/insider-threat) * [What is Malware?](https://www.upguard.com/blog/malware) * [What are the OWASP Top Ten?](https://www.upguard.com/blog/owasp-top-ten) * [Common Types of Malware And How to Recognize Them](https://www.upguard.com/blog/types-of-malware) Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) October 29, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)