Technique

Business Email Compromise

Also known as: Email Account Compromise, CEO Fraud, Vendor Email Compromise, False Invoice Scheme, Payment Diversion Fraud, Mandate Fraud, Payroll Diversion

DELIVERY

Impersonating executives, vendors, or trusted parties via email to authorize fraudulent wire transfers, redirect payments, or extract sensitive data. Attackers use spoofed or compromised email accounts to exploit trust relationships within organizations. FBI IC3 reports $2.77 billion in losses from…

Common attack flows

How it fits in a scam

This technique shows up duringDELIVERY

Before

After

This is often where the scam ends.

Defense

How to defend against this

How to spot it

  • Urgent wire transfer or gift card purchase requests from executives
  • Payment routing changes or vendor banking detail modifications arriving by email only
  • Spoofed sender addresses with subtle character substitutions (e.g. rn for m.co vs .com)
  • Pressure to bypass established financial approval procedures or keep request private
  • Unusual email timing
  • tone or grammar inconsistencies from known contacts
  • Mismatched reply-to address vs display name or known sender domain
  • Unexpected requests for employee PII from HR or finance staff
  • Requests to switch communication channel from email to another communication channel.

Tools you can use

Steps you can take

Seen in the wild

Where we’ve seen it

Commonly targets

Further reading