Definition
Business email compromise
BEC
Business email compromise is the fraud of getting a company to transfer money to an account the fraudster controls, by impersonating over email a director, a supplier or a customer whose bank details have supposedly changed.
The commonest form is not dramatic: a message in a known supplier's name announces a change of bank details, a few days before an expected payment. The amount is consistent, the tone is ordinary, the invoice is real. The transfer goes out for the right amount to the wrong account.
13.5%
of assistance requests from French companies and associations concerned payment-transfer fraud in 2025, with the number of cases up 93% year on year.
Three impersonation techniques deliver it: exact domain spoofing, which DMARC blocks; the cousin domain, which it does not; and the misleading display name, which it does not either. Complete technical protection handles the first and leaves the other two to attention.
- Also known as
- BEC, business email compromise, CEO fraud, invoice fraud, payment diversion fraud, whaling, FOVI