BEC Fraud: Stop Billion-Dollar Wire Theft Now

What's Happening Right Now

Business Email Compromise remains one of the highest-dollar cybercrimes reported to the FBI Internet Crime Complaint Center, and 2025 IC3 reporting continues to show BEC and CEO fraud among the costliest categories for U.S. and global organizations. Reported losses run into the tens of billions annually across fraud types, and BEC incidents often produce large single-event losses because attackers aim for one or more wire transfers instead of stealing small numbers of accounts.

The threat has changed in 2026. Attackers combine compromised email accounts, lookalike domains, and AI-generated language to write convincing messages that no longer have classic spelling errors. They monitor inboxes for invoice exchanges, payroll cycles, and M&A chatter, then strike when timing is normal enough to bypass suspicion.

How This Attack Works

BEC succeeds by blending social engineering with email mechanics. MITRE ATT&CK labels techniques such as phishing and impersonation, but the practical sequence is easy to understand.

1. Initial access

Attackers gain access through credential phishing, session-token theft, or malware. Once inside an executive or finance mailbox, they can read threads, create inbox rules, and reply within real conversations.

2. Reconnaissance

The attacker waits. They study how a vendor is named, what invoice numbers look like, what the CFO calls the controller, and which days payments are approved. AI can summarize threads and draft replies in the victim's tone.

3. Impersonation

The attacker spoofs or compromises a trusted identity: the CEO, a law firm, a title company, a software vendor, or a payroll provider. Messages often arrive during a busy quarter-end, a system outage, or an executive travel window.

4. Payment request

The attacker sends an urgent request: change bank details, release a pending invoice, process payroll corrections, or wire funds to a new account. They may include realistic attachments or reference prior emails.

5. Verification failure

A staff member checks the email, not the source. If the phone number is taken from the message, the attacker answers. If approval is based on an urgent tone, controls fail.

6. Transfer and delay

Funds move, often through mule accounts, and may be unrecoverable. Detection can happen days later when the real vendor calls about nonpayment.

Real-World Examples

Ubiquiti Networks reported a 2015 BEC fraud that led to a $46.7 million loss after attackers impersonated suppliers and submitted fraudulent payment requests. The incident showed that even a global company can suffer when payment verification relies on email alone.

Google and Facebook were also targets of a long-running BEC scheme involving fake invoice emails sent by a Lithuanian fraudster; the scheme resulted in more than $100 million in losses across the targeted companies before law enforcement intervention. These cases are not exotic. They involve familiar elements: forged suppliers, altered banking details, and pressure to pay quickly.

Many smaller incidents never make headlines. A regional accounting firm may wire $250,000 after a fake vendor email. A nonprofit may send payroll funds after a spoofed HR request. A construction company may pay a subcontractor twice because bank details were changed mid-project.

Who Is Most at Risk

Organizations with 10 to 500 employees are especially exposed because they often have high transaction volume but weak separation of duties. Finance staff may be skilled, yet one person may both receive invoices and initiate payments. Executive assistants, AP/AR teams, HR/payroll, and project managers are prime targets.

High-risk industries include accounting, law, healthcare, real estate, construction, manufacturing, logistics, technology, nonprofits, and any business moving money to many vendors or international accounts. Companies with remote teams, frequent new suppliers, or manual invoice workflows are attractive targets.

Warning Signs to Watch For

Treat these as stop points, not suggestions.

• A bank account change, new wire destination, or new invoice account arrives by email without prior verification.
• A message is urgent, secretive, or asks to bypass normal approval.
• The sender domain looks close but is not exact, such as hyphens, typos, or a new TLD.
• The reply-to address differs from the displayed sender.
• A vendor suddenly switches from secure portal uploads to email attachments.
• An executive requests a payment while traveling and asks not to call.
• Invoice references are vague, totals are unusually high, or multiple invoices are batched together.
• A finance employee is asked to use a personal phone, text, or messaging app for approval.
• Payment is requested after hours, on weekends, or outside normal approval windows.

How to Protect Your Business

Layered controls aligned with NIST CSF and CIS Controls can reduce BEC risk quickly.

1. Verify payments through a hard control

Require two-person approval for all wire transfers, ACH changes, and payroll changes. Use a callback to a phone number from the existing vendor file, not from the email. If banking details change, require confirmation through a previously verified channel and a delay before the first payment.

2. Lock down email and identity

Enforce phishing-resistant MFA such as hardware keys or passkeys, not SMS codes. Enable DMARC, SPF, and DKIM with monitoring, and block or quarantine external mail that fails authentication. Require admin approval for mailbox forwarding rules and alert users when forwarding rules are created.

3. Reduce blind trust in email

Configure external sender warnings, display-name change alerts, and lookalike-domain warnings. Use secure portals for invoices and document sharing rather than email attachments. For high-value payments, require a known portal link or a signed document from a verified contact.

4. Train staff on scenarios, not slogans

Train AP/AR, payroll, and executives on specific scripts: what to do when a vendor changes bank details, what to do when the CEO emails from a personal account, and what to do when an account is compromised. Practice with mock BEC emails.

5. Prepare for the first hour

Create a BEC incident playbook. If funds are sent, call the bank immediately, preserve email logs, report to the FBI IC3, and contact CISA if infrastructure or credentials are compromised. Speed is the difference between a near miss and a permanent loss.

Quick Action Checklist

• Require two-person approval for every wire transfer, ACH change, and payroll change.
• Verify every new vendor payment or bank-detail change by callback using a number already on file.
• Enable phishing-resistant MFA with passkeys or hardware keys; remove SMS-only MFA for finance, executives, and admins.
• Block or quarantine email that fails DMARC and alert on mailbox forwarding rules.
• Add external sender warnings and lookalike-domain alerts to your email gateway.
• Move invoice and payroll document exchanges to a secure portal, not email.
• Run a 30-minute BEC tabletop exercise with finance and leadership this week.
• Save the FBI IC3 complaint reporting site and your bank fraud hotline in the finance playbook.

Start Here This Week

Choose one control that stops money movement and implement it by Friday. If you only have time for one step, make it mandatory out-of-band verification for every payment and every banking change. BEC works when email is treated as truth. Your job is to make the email ask a question and force the answer to come from a trusted source.