On a Thursday afternoon, an accounts payable clerk at a 300-person manufacturer gets a reply in an email thread she has shared with a supplier for two years. The supplier's controller writes that their bank has changed after an audit and attaches a letter on company letterhead with the new account details. The message comes from the controller's real address. She updates the vendor record, and the next payment run sends $186,400 to the attacker. Nobody notices for three weeks, until the supplier calls about an overdue invoice.
That is business email compromise (BEC): fraud that uses email to impersonate a trusted executive, employee or supplier and redirect money or sensitive data. On the CompTIA Security+ SY0-801 exam, BEC is named under objective 5.6 as a topic that security awareness training has to cover, and its indicators overlap with the social engineering attacks in objective 2.5. This lesson covers the common BEC schemes, the difference between spoofed messages and compromised accounts, the traces each leaves, and the controls that stop the payment even when the email is flawless.
Business email compromise steals money with words, not malware
Most BEC messages contain nothing a filter would flag: no link, no attachment, no malware. They're short, plain requests in a familiar tone, asking someone with authority over money or data to do something that's a normal part of the job. Pay this invoice. Update these bank details. Send me the employee tax forms. Because each element looks routine, the dependable defense is a process that checks the request itself.
The losses are among the largest of any cybercrime. In the annual reports of the FBI's Internet Crime Complaint Center (IC3), BEC ranks second only to investment fraud, with losses of about $2.9 billion in 2023 and about $2.8 billion in 2024, and those figures count only incidents that victims reported.
BEC uses the same psychology as other social engineering, weighted toward authority, urgency and secrecy: the CEO is in a meeting and can't talk, the deal is confidential, the payment must go out today. It also relies on familiarity. A request that arrives inside an existing thread, with the right invoice numbers and the right names, doesn't feel like an attack.
BEC follows a handful of repeatable schemes
| Scheme | Who gets the message | What they're asked to do |
|---|---|---|
| CEO fraud | Finance staff, executive assistants | Wire money for a confidential deal, or buy gift cards |
| Vendor invoice fraud | Accounts payable | Pay a fake invoice or send payments to new bank details |
| Payroll diversion | HR or payroll | Change an employee's direct deposit account |
| Data theft | HR, finance | Send W-2 forms or employee records |
| Real estate closing fraud | Home buyers, title and escrow staff | Wire closing funds to new instructions |
CEO fraud impersonates an executive. The classic version is an email to the controller about an acquisition nobody else knows about, with an outside lawyer's name attached and a demand for discretion. A cheaper version goes to any employee: "Are you at your desk? I need a favor," followed by a request for gift card codes.
Vendor invoice fraud impersonates a supplier, as in the opening example. When the attacker controls the supplier's real mailbox, it is sometimes called vendor email compromise, and it is the hardest form to catch, because everything about the email is genuine.
Payroll diversion sends HR a message from an "employee" asking that this month's pay go to a new account, often a prepaid card or an online-only bank. The real employee finds out on payday.
Data theft BEC asks for information instead of money. A request "from the CEO" for every employee's W-2 form gives the attacker what they need to file fraudulent tax returns in those employees' names.