Business email compromise (BEC) is a scam in which a criminal impersonates a trusted person — your CEO, a supplier, a colleague in finance — over email and talks an employee into sending money or sensitive information. There is no malware for a filter to catch and often no link to click: just a plausible message that arrives in a busy inbox. It works often enough that BEC fraud with a financial loss was 15% of all business cybercrime reports to the Australian Signals Directorate in 2024-25, the largest single category of business reports alongside email compromise without a loss.
TL;DR
- Business email compromise is fraud by impersonation: a convincing email asks staff to change payment details, pay a fake invoice or send data.
- BEC fraud with financial loss made up 15% of Australian business cybercrime reports to ASD in 2024-25.
- Filters usually miss it because the email carries no malicious link or attachment — the attack targets people and process, not software.
- The control that stops most BEC costs nothing: verify any payment or detail change by phone, on a number you already had.
What is business email compromise?
Business email compromise is an attempt to defraud an organisation of money or assets using email impersonation. The criminal poses as someone your staff already trust and rely on — a supplier, an executive, an IT provider — and manufactures a reason for money or information to move. The Australian Signals Directorate defines it the same way and specifically warns about suspicious changes to banking details and payment instructions.
The main variants, in the order Australian businesses report them:
| BEC type | How it plays out | Who gets targeted |
|---|---|---|
| Payment redirection / invoice fraud | A supplier emails new bank details, or a fake invoice arrives that looks like every other one | Accounts payable, bookkeepers, finance teams |
| Executive impersonation (CEO fraud) | The boss emails asking for an urgent, discreet payment or a list of staff details | Executive assistants, reception, junior staff |
| Payroll diversion | Someone impersonating an employee asks HR to change their salary account | HR and payroll staff |
| Supplier mailbox takeover | A real supplier's account is compromised, so the request comes from a genuine address | Anyone who pays suppliers |
| Gift card and urgent request scams | A familiar name asks for gift cards or credentials under time pressure | Frontline and admin staff |
How a BEC attack actually unfolds
- Reconnaissance. The criminal studies your website, LinkedIn and any leaked data to learn who does what: who pays invoices, who signs off payments, which suppliers you use.
- The setup. They either compromise a real mailbox or register a lookalike domain — one changed character in a name is usually enough to pass a glance.
- The warm-up. Often a harmless first message: a quick question, a reply-to thread, something that gets a normal answer. Generic opening messages make up the large majority of first BEC contacts.
- The ask. Urgency plus secrecy: an invoice due today, a payment that must not go through the usual process, bank details that changed this morning.
- The close. Pressure if the employee hesitates, and silence about anything that would trigger a phone call.
Why email filters rarely stop it
A spam filter looks for malicious signals: bad links, infected attachments, spoofed infrastructure. A BEC email has none of them. It is plain text from a working mailbox, sometimes a real one that was stolen last week. That is why technical email security and staff awareness are complements rather than alternatives — the filter shrinks what arrives, and people handle what gets through. The channel-only attack is also why the ASD's reporting data shows email compromise categories together accounting for about a third of business cybercrime reports in 2024-25.
What BEC costs Australian businesses
The reported numbers are large and rising:
- $56,571 — the average self-reported cost of cybercrime per report for Australian small business in 2024-25, up 14% on the year before (ASD Annual Cyber Threat Report 2024-25).
- $80,850 — the average across all business sizes, a 50% jump in twelve months.
- $166.8 million — what Australians reported losing to payment redirection scams in 2025, up 9.3% (Scamwatch).
- 15% — the share of business cybercrime reports to ASD that were BEC fraud with a financial loss in 2024-25.
And those are only the incidents that get reported. A redirected payment caught at the bank, or an invoice stopped by one suspicious accountant, never appears in any statistic — which is exactly the outcome a good process produces.
How to spot a BEC email
The red flags repeat across every variant:
- Urgency plus secrecy. Every payment-fraud email presses both buttons: act now, tell no one. Real finance processes rarely need either.
- Changed bank details. A supplier's new account number arrives by email alone. This is the single most common lever.
- Display-name tricks. The name reads CEO or the supplier's name, but the underlying address is a lookalike domain — check the actual address, character by character.
- A thread you never started. Reply-to hijacking reuses a genuine-looking conversation to borrow trust.
- Unusual channel shift. The director who usually calls now emails; the supplier that always posts invoices suddenly prefers email.
The one control that stops most BEC
Verification, done properly, defeats nearly every BEC variant: payment details never change over email alone. A new bank account is confirmed by phone, using a number you already had — not one printed in the email itself. The same rule covers urgent executive requests (call the executive), payroll changes (call the employee on their stored number) and anything that breaks the normal process.
That rule is a habit, not a document, which is why it belongs in regular security awareness training rather than in a policy binder. Short, monthly lessons on the current scams — with the finance team getting the invoice-fraud deep dive — are what make the call-back reflex fire when a real request lands at 4:45 on a Friday.
Where phishing simulations fit
BEC itself is hard to simulate — it is a conversation, not a link. But the recognising skills overlap almost completely: checking the sender address, questioning urgency, verifying before acting. Realistic phishing simulations rehearse those reflexes monthly with a 100+ template library that mirrors the invoice and payment lures actually circulating, and anyone who clicks lands in a short remediation course the same week. Teams that run the loop consistently see click rates fall sharply within months — the practice, not the policy, does the work.
Measuring whether your human layer is improving
BEC risk is a human-layer risk, so it needs human-layer measurement: phishing click rates, report rates, training completion, repeat clickers. Human risk reporting turns those into a monthly per-person score, so the two people in accounts who keep clicking are visible long before a real invoice fraud lands on their desk. For a small business, the gap between a caught-and-reported culture and a head-in-the-sand one shows up in those numbers first — and shows up in the ASD cost figures if it is ignored.
FAQ
What is business email compromise in simple terms? A scammer pretends, over email, to be someone you trust and asks for money or information. No virus, no link — just a convincing impersonation aimed at whoever handles payments or data.
How is BEC different from phishing? Phishing usually casts a wide net with a malicious link or attachment; BEC is targeted, text-only and aims at a specific payment or data transfer. Phishing is the net, BEC is the spear.
Can email security software stop BEC? Partly. Impersonation warnings and domain checks help, but a plain-text email from a clean or stolen mailbox gives a filter almost nothing to detect. Verification process and staff training carry the rest.
What should we do if money already went out? Contact your bank immediately and ask for a payment recall, report it to police through the ASD's ReportCyber, and then work out which step of the verification process failed.
Which roles need the most BEC training? Accounts payable, bookkeepers, HR and anyone assisting executives. They receive the asks, so they need the verification habits.
Is BEC covered by cyber insurance? Policies vary widely, and many now require evidence of staff training and payment-verification controls before paying fraud claims. Check your wording before you need it.
One last thing
The most profitable minute in BEC defence is a phone call. Almost every large payment-redirection loss had a verification step available that somebody skipped because the request seemed normal. Train the call-back habit, rehearse it with simulations, and measure it monthly.