Business email compromise (BEC) is a specialized phishing technique that targets individuals with the intent of tricking them into sending money or sharing sensitive information. It remains one of the most lucrative types of cybercrime, with losses reaching almost $3 billion in more than 21,000 cases reported to the FBI in 2023.1
The methods perpetrators use in BEC have changed as technology and business processes have evolved. But this crime still depends on establishing and exploiting trust. Perpetrators may impersonate people who work for the same organization, often a boss, senior executive or consultant, such as legal counsel, or an established vendor or customer. They leverage persuasive social engineering tactics to convince people of their identities and the legitimacy of their requests.
Developments in artificial intelligence (AI) and account hacking have made some BEC scams very difficult to detect. But the best defense is still a workforce that is alert to this persistent threat and able to balance efficiency with security objectives.