5 min read
Business email compromise, explained for small business owners
"Business email compromise", or BEC, sounds technical. It isn't. It means someone uses email, either a fake address or a stolen real one, to trick a business into sending money or sensitive information.
In its 2024 report, the FBI's Internet Crime Complaint Center counted 21,442 business email compromise complaints and about $2.77 billion in reported losses in the U.S. alone. A bank transfer, once sent, is very hard to get back.
The three forms you're most likely to meet
- The fake vendor: someone pretends to be one of your suppliers and asks you to pay into a new account.
- The fake boss: an email that looks like it's from the owner or a manager asks for an urgent transfer or gift cards.
- The hijacked mailbox: a real vendor's or colleague's email account is taken over, and the scammer writes from it. This is the hardest to spot, because the address is genuine.
Why it works so well
BEC doesn't attack your computer. It attacks a routine: an invoice arrives, it looks normal, someone pays it. The scammer only needs to change one detail, the bank account, and to create a little pressure so nobody stops to check.
Signs worth a second look
- Any request to change where you send money.
- A sender address that is close to, but not exactly, the one you know.
- Replies that would go to a different address than the sender, often a free Gmail or Outlook account.
- Pressure to act today, or a request not to call.
- A new tone, new phone number or new PDF layout from a vendor you've paid for years.
A protection plan for a team of one to five
- 1Write one rule down: no bank change is accepted by email alone. Every change gets a callback to a known number.
- 2Keep a short list of your vendors' verified phone numbers, taken from old invoices or contracts.
- 3For large payments, have a second person approve, even in a two-person business.
- 4Turn on two-factor authentication for your own email, so nobody can hijack your mailbox to fool your clients.