Phishing basics
What is business email compromise and how do small businesses stop it?
Updated
Short answer
Business email compromise (BEC) is fraud where criminals use a hijacked or convincing fake email account to trick a business into sending money or changing payment details. The FBI's IC3 recorded over $3 billion in reported BEC losses in 2025. Small businesses stop it mainly with a call-back rule for any payment change, multi-factor authentication on email, and staff trained to spot pressure and unusual requests.
What is business email compromise?
Business email compromise is a scam aimed at people who handle payments. The FBI's Internet Crime Complaint Center (IC3) describes it as targeting businesses or individuals working with suppliers or regularly making wire transfers, carried out by compromising email accounts and other communication channels through social engineering or computer intrusion to conduct unauthorized transfers of funds.
Unlike most phishing, BEC often contains no malicious link or attachment. It may be a plain, polite email asking for a payment, a gift card purchase or a change of bank details. That makes it harder for email filters to catch and easier for a busy person to act on.
How common and costly is business email compromise?
In the United States, the FBI IC3 2025 Internet Crime Report lists 24,768 BEC complaints with $3,046,598,558 in reported losses. Across all crime types, IC3 received 1,008,597 complaints reporting $20.877 billion in losses that year. The FBI notes that investment fraud was the largest loss category, followed by business email compromise.
The same report says that in 2025, businesses reported losses of over $30 million to BEC scams involving AI, for example chat tools used to write convincing emails that mimic a company's executives.
In Canada, the Canadian Anti-Fraud Centre (CAFC) reported in a May 13, 2026 release that spear phishing fraud losses were in excess of $68 million CAD in 2025. It notes that small and medium-sized businesses are common targets, particularly in construction, contracting and real estate.
What does a business email compromise attack look like?
Most BEC attacks follow a handful of patterns. The common thread is a believable sender and a request to move money.
- Supplier or vendor fraud: a message that appears to come from a regular supplier says its bank details have changed and asks that the next invoice be paid to a new account.
- Executive impersonation: an email that seems to come from the owner or a senior manager asks for an urgent wire transfer or gift cards, often while that person is travelling.
- Hijacked conversation: criminals who have taken over a real mailbox reply inside an existing email thread, so the request looks completely normal.
- Payroll diversion: a request to change an employee's direct deposit details.
- Real estate and legal payments: fake closing instructions or trust account details sent just before a large transfer.
What are the warning signs of business email compromise?
The CAFC lists warning signs that apply to almost every BEC attempt. Staff who handle payments should treat any of these as a reason to stop and verify.
- Urgent pressure to pay now or keep the request quiet.
- Lookalike email addresses with a small change to a familiar domain.
- Unexpected wire instructions or a sudden change to banking information.
- Notices about invoices that have already been paid.
- A request that skips the usual approval steps.
How do small businesses stop business email compromise?
The most effective controls are simple process rules, backed by basic account security. Technology alone will not catch a well-written email from a real but compromised account.
- Call back before paying: the CAFC advises verifying payment instructions through a separate channel and confirming banking changes using contact details you already trust, never the ones in the email.
- Require two people for large or changed payments, so no single email can move money on its own.
- Turn on multi-factor authentication for every email account. The Canadian Centre for Cyber Security recommends phishing-resistant options such as FIDO-based methods, plus number matching to counter MFA fatigue attacks.
- Watch for mailbox rules: attackers who take over an account often add forwarding or hiding rules, so review them as part of routine checks.
- Train staff with realistic practice, including payment change requests, so the call-back habit becomes automatic.
What should you do if a BEC payment has already gone out?
Speed matters more than anything else. The IC3 report says that if you discover a fraudulent transfer, time is of the essence: contact your financial institution immediately and request a recall of the funds.
In the US, file a complaint at ic3.gov regardless of the amount, with full transaction details. The IC3 Recovery Asset Team works with banks to freeze funds. In Canada, contact your bank, report to the CAFC through the Report Cybercrime and Fraud system and contact your local police. The CAFC notes that reporting fraud quickly may improve the likelihood of fund recovery.
Then secure the mailbox: reset the password, revoke active sessions, check for forwarding rules and confirm multi-factor authentication is on.
NetMinder Security is a phishing simulation and awareness training platform that MSPs resell to small businesses on Microsoft 365. Its monthly practice emails are modelled on real scams, and anyone who clicks sees a two minute lesson with a three question check at that moment.
Sources
- FBI IC3: 2025 Internet Crime Report
- Canadian Anti-Fraud Centre: partners assist in $3.5M recovery linked to payment redirection fraud (May 13, 2026)
- Canadian Centre for Cyber Security: Secure your accounts and devices with multi-factor authentication (ITSAP.30.030)
- Canadian Centre for Cyber Security: Spotting malicious email messages (ITSAP.00.100)