What is business email compromise?

What does it look like at a firm?

BEC is a scam targeting businesses or individuals working with suppliers and/or businesses regularly performing wire transfer payments.

It arrives at the moment money is due. A client is told the firm's bank details have changed. A supplier's invoice comes with a new account. A closing wire, a builder's draw or a payroll change is redirected by one email that looks routine.

Nothing is broken into for the first two kinds below. The email is believed because of the name it carries. The money goes before anyone calls to confirm.

The FBI's Internet Crime Complaint Center recorded 24,768 complaints of business email compromise in 2025, with 3,046,598,558 US dollars in reported losses (2025 IC3 Annual Report (Internet Crime Report), pages 25 and 26).

How is it done?

Three ways. A firm can meet all three in one year.

1. A forged sender on the firm's own domain.The email shows the firm's real address. It is delivered where the domain publishes no DMARC rule asking receiving servers to refuse it, or one set to p=none.
2. A look-alike name.The email comes from a domain one letter or one word away from the firm's, set up to send and receive mail. Clients rarely read an address letter by letter.
3. A mailbox already taken.Someone signs in to a real mailbox at the firm or at a client, often with a password from an earlier breach or through a relay sign-in page, then writes from inside the thread.

Which of the three can be seen before the money moves?

Two of them leave marks in public records first. The forged-sender gap is in the domain's own published records, readable by anyone. A look-alike has to be registered, given mail records and often a certificate. Each of those is public before the first email goes.

For a firm we watch, the names made from its own are read every hour. Each day's public list of newly registered names is matched against its name overnight. In October 2026 Canada's Cyber Centre warned of callers posing as IT staff sending employees to sign-in pages whose addresses may carry the firm's own name.

Canada's Cyber Centre advises organizations to monitor for newly registered domains impersonating the organization.

The third way is not visible beyond the firm's walls. A mailbox taken over is used from inside. The call that sends someone to a relay page happens on the phone. What can be seen are the signs before it: firm addresses in breach data and lure names registered ahead of the call.

Public breach lists rarely show this fraud at all. A payment sent on a forged invoice is seldom a reportable data breach, so it does not reach the lists that count breaches. The FBI's loss figures are where it appears.

How common is the gap in a firm's own records?

LeakTrace index, readings to 8 October 2026: 3 in 4 of the professional firms we read have no published rule telling mail servers to refuse mail forged in their name.

That means no DMARC record, or one at p=none. The method, the dates and the figures by line of work are on the Index's own page.

• The LeakTrace Index: method and figures

How does the attack run, step by step?

1. The name.A look-alike is registered, or the firm's own domain is found to publish no rule against forgery. Both are public facts anyone can read.
2. The setup.Mail records go on the look-alike. A certificate is often issued. Sometimes a copy of the firm's site goes up.
3. The message.An email reaches a client or a member of staff at the moment money is due: an invoice, a closing, a draw, a payroll change.
4. The payment.The money goes to the new account. What comes back depends on how fast the bank is told, which is why the pages on money sent to a fraudster start with the bank.

What should a firm check this week?

Instruct employees to independently verify unexpected IT calls requesting MFA, passkey or password changes, regardless of caller ID or urgency

Three asks first, each with what it changes, whether it can stay on and how to undo it. One more follows.

1. Read your DMARC record.Steps: look up the text record at _dmarc in front of your domain; if it is missing or says p=none, move to p=quarantine once your genuine senders pass, then to p=reject. What changes: forged mail goes to spam, then is refused. Stays on: yes. To undo: set p=none again.
2. Look for names made from yours.Steps: search for your name with one letter changed, a hyphen or another ending; note any that has mail records. What changes: nothing in your systems. Stays on: repeat it monthly or have it watched. To undo: nothing to undo.
3. Agree a call-back rule.Steps: confirm any change of payment details by phone, on a number already on file, never one in the email. What changes: a changed payment waits for one call. Stays on: yes, as a written rule. To undo: retire the rule in writing.