Business email compromise (BEC) is a scam where an attacker uses a real or lookalike business email account to trick an employee into paying money, changing payment details or handing over data. In Australia, BEC made up 15% of cybercrime reports from businesses in FY2024-25, and the average self-reported cost of a cybercrime incident reached $56,600 for a small business in the same period (ASD Annual Cyber Threat Report 2024-25). The number people miss: BEC does not rely on malware, so email filters catch far less of it than a typical phishing blast — the attack is aimed squarely at the person reading the email.
TL;DR
- Business email compromise is fraud using a real or lookalike business email account to redirect payments or extract data.
- BEC made up 15% of Australian business cybercrime reports in FY2024-25; small businesses averaged $56,600 self-reported cost per incident.
- The three common forms: spoofed supplier bank-detail changes, impersonated executives, and compromised-mailbox invoice forwarding.
- Email filters struggle with BEC because it rarely carries malware or a suspicious link.
- The single strongest control: verify every payment-detail change by phone, on a number you already hold — never one supplied in the email.
What is business email compromise?
BEC is not one attack but a family of them, all sharing the same shape: a message that looks like ordinary business, sent from an address the recipient has reason to trust. It differs from bulk phishing in two ways. It is targeted — the attacker has usually studied your org structure, suppliers or payment processes first — and it asks for money or data rather than a password.
The Australian Signals Directorate logged more than 84,700 cybercrime reports in FY2024-25, roughly one every six minutes. Business email compromise is the category behind the largest reported losses for many of those businesses, because a single convincing payment-redirection email can move tens of thousands of dollars in one transfer.
How a BEC attack works
- Reconnaissance. The attacker studies the target from the outside: supplier names on public registers, executive names on LinkedIn, payment terms visible in job ads or leaked documents.
- The approach. They either spoof a lookalike domain (supplier-bankdetails.com), compromise a real mailbox through a credential-phishing email, or register a display name that renders identically to a real colleague.
- The ask. A payment is redirected to a new bank account, an urgent invoice is attached from the CEO or a supplier, or payroll details are changed for a staff member who is away.
- The pressure. Urgency and authority: an audit deadline, a final notice, a manager on leave who needs it cleared today. Verification is exactly what the urgency is designed to prevent.
- The cashout. Once the payment lands in the mule account, it is moved within hours. Recovery after a day is rare — which is why the control has to sit before the payment, not after it.
The three common BEC lures
| Lure | What it looks like | The tell |
|---|---|---|
| Supplier bank-detail change | A familiar supplier emails updated payment details before an invoice is due | Any bank-detail change is treated as fraud until verified by phone on a number already on file |
| CEO / executive impersonation | The boss emails, sometimes on leave, asking for an urgent confidential payment | Verify by phone or in person; executives do not need payments kept secret from finance |
| Compromised mailbox | A real colleague's account sends an invoice thread that quietly swaps the attached details | The thread history is copied; the attachment or footer is where the swap hides |
Why BEC beats email filters
Email security tools are built to catch malicious links, attachments and known-bad senders. A BEC email can be plain text: no link, no attachment, a valid signature and a real-looking domain. Roughly 60% of breaches involve a human element — an error, a clicked link or a manipulated employee (Verizon, 2025 DBIR) — and BEC is the purest human-element attack. The layer that stops it is procedure plus training: people who verify out-of-band and report suspicious messages in minutes.
Teams running monthly phishing simulations that include payment-fraud scenarios build exactly that reflex, and human risk reporting shows whether finance and admin staff — the teams BEC targets first — are improving month over month.
How to stop BEC: the five controls
- Out-of-band verification. Any change to payment details, any urgent payment request, is confirmed by phone on a number you already hold. Every time, no exceptions, including for known suppliers.
- Two-person rule. Payments above a set threshold require approval from two people. It slows a fraudulent transfer down and catches the lone-employee scenario.
- MFA everywhere. A compromised mailbox usually starts with a stolen password; MFA removes the bulk of automated account takeover — Microsoft research puts the reduction at 99.22%.
- Train the reflex. Short monthly lessons on payment fraud and executive impersonation, with simulations that rehearse the verification step. Cyber Aware's security awareness training runs this cadence automatically.
- Report fast. A suspected BEC email reported in minutes can be pulled from every other inbox before a second person pays. If money has moved, call your bank immediately and report to ReportCyber.
Is business email compromise the same as phishing?
No. Phishing is the delivery method — a fake email designed to make you click or comply. BEC is the outcome the attacker wants: a fraudulent payment or data loss achieved through email. BEC often begins with a phishing email that compromises a mailbox, and the most expensive BEC attacks arrive as plain text with no link at all.
What should staff do if they suspect a BEC email?
Do not reply, do not call any number listed in the email, and do not open attachments. Verify the request through a channel you already trust — the supplier's account manager, the executive in person. Then report it through your report button so the rest of the team hears about the campaign the same day.
Does a reported BEC attempt go to the authorities?
Yes. Scam and fraud attempts can be reported to Scamwatch, and cybercrime incidents to ReportCyber. Reporting matters beyond the individual case: the ASD's FY2024-25 figures above come from reports, and they drive the warnings other businesses act on.
FAQ
What is business email compromise? Fraud carried out through a real or lookalike business email account — typically a redirected payment, a fake invoice or an impersonated executive — rather than malware or a password grab.
How common is BEC in Australia? BEC made up 15% of business cybercrime reports to the ASD in FY2024-25, out of more than 84,700 total reports for the year.
How much does a BEC incident cost? The average self-reported cost of a cybercrime incident was $56,600 for an Australian small business and $97,200 for a medium one in FY2024-25; a single redirected payment can exceed those figures on its own.
Can email filters stop BEC? Partly. Filters catch the malicious-link variants, but plain-text BEC with a lookalike domain and a real signature often passes through — which is why verification procedure and training carry the rest.
What is the fastest way to recover a BEC payment? Call your bank the moment the transfer is noticed — payments recalled within hours have a real recovery chance; after a day the money has usually been moved on.
Who in a company should be trained for BEC? Finance and accounts staff first, then anyone who approves payments or receives supplier invoices — plus executives, who are the most impersonated and often the least trained group.
One last thing
Write the verification rule down and make it company policy: no bank-detail change is ever actioned on the strength of an email alone. The businesses that lose money to BEC are almost never short of smart staff — they are short of a procedure that overrides urgency.