What is business email compromise?
Business email compromise is fraud by email. Someone writes as a person you trust, such as a supplier, a client or your own manager, from a forged or stolen address. They ask for a payment or private details. The money goes to an account the fraudster controls.
Last read from the sources at the foot of this page.
What does business email compromise mean for a business?
The email looks routine. It might be a supplier with new bank details, a client asking where to send a deposit or a partner who needs a payment made quickly.
The RCMP lists the warning signs a business should watch for.
Financial transaction requests with pressure to act quickly; demands for secrecy; not following normal procedures; involving direct contact with a senior official you are not normally in contact with.
How does the fraudster send the email?
There are two ways. The fraudster forges your address, which works when your domain publishes no rule telling mail servers to refuse forged email. Or the fraudster signs in to a real mailbox with a stolen password and writes from inside it.
The criminal, using a spoofed or compromised email account of the supplier, informs the business of a change in payment details.
What should you do about it?
Contact the source through another means of communication (e.g. by phone) to confirm the request is legitimate.
- Confirm every change of bank details by phone.Use a number you already have on file, never one in the email.
- Ask for two people to approve a new payee or a large payment.
- Publish a DMARC record with a policy of reject.It tells receiving mail servers to refuse email that forges your domain.
- Turn on two-step sign-in for every mailbox.A stolen password alone then does not open it.
- If money has gone, call your bank first and ask it to recall the payment.
Where is the change made?
Your DNS settings, for the DMARC record that tells inboxes to refuse forged email. Your email account settings, for two-step sign-in on each mailbox. The call-back rule belongs in how your firm approves payments.
What else do people ask about this?
Is business email compromise the same as phishing?
It is a kind of phishing aimed at a payment. Most phishing wants a click or a password. A business email compromise message wants money moved and often carries no link at all.
Does a DMARC record stop it?
A DMARC record at p=reject stops email that forges your exact domain. It does not stop a look-alike domain or a real mailbox someone signed in to. Those need the call-back rule and two-step sign-in.
Who do I report it to?
Call your bank first if money has gone. In Canada, report it to the Canadian Anti-Fraud Centre and your local police. In the United States, report it to the FBI Internet Crime Complaint Center.
Where does this come from?
- Royal Canadian Mounted Police, Business Email Compromisercmp.caRead 16 October 2026
See what is open before anyone else does.
We read your domain from outside and show each way in with a check anyone can re-run.