Business Email Compromise (BEC)
Business email compromise (BEC) is a fraud in which a criminal compromises or impersonates a legitimate email account, posing as an executive, vendor or colleague, to trick someone into sending money or sensitive information.
Last updated October 13, 2026
How business email compromise works
The FBI and FinCEN describe BEC as a scam that targets people who make legitimate fund transfers. Criminals typically gain access to a real email account through social engineering or hacking, or they send messages from a lookalike address. They then send payment instructions that appear to come from a trusted party, such as a new bank account for a vendor, an urgent wire request from a supposed executive, or a change to payroll details.
The FBI notes that the money is not always sent by traditional wire. Transfers to third-party payment processors, peer-to-peer platforms and cryptocurrency exchanges have also appeared in these schemes. In its public service announcement covering October 2013 through December 2023, the FBI's Internet Crime Complaint Center reported more than 305,000 incidents and roughly $55.5 billion in exposed losses worldwide.
Example
The finance lead at a software company receives an email that looks like it came from a long-time vendor. It says the vendor has changed banks and asks that the next invoice be paid to a new account. The message is polite, references a real project and creates mild urgency. The payment is sent. Weeks later the real vendor asks about the unpaid invoice. In this scenario the vendor's email had been compromised, and the funds were sent to a criminal account.
BEC vs. related terms
- Phishing. Phishing is a deceptive message designed to steal credentials or install malware. BEC is the payment fraud that may follow, such as a fake invoice change, and it can also happen without any phishing at all.
- Social engineering fraud. Social engineering fraud is the broader category of tricking a person into taking action. BEC is one common form. The same phrase is also used for a policy extension, so check how each policy defines it.
- Ransomware. Ransomware locks systems and demands payment. In BEC, the victim's own staff sends the money.
- Crime insurance. Crime insurance generally addresses theft and fraud against the insured, including some funds-transfer fraud. Whether it responds to a voluntary payment on a fraudulent instruction depends on the form and any endorsement.
- Account takeover vs. spoofing. A compromised real account sends genuine-looking mail from the true address. Spoofing uses a lookalike address or domain. The controls that help differ.
A second example: an urgent request that looks like the CEO
A hypothetical operations lead at a fintech company receives an email that appears to come from the CEO, who is traveling. It asks for an urgent transfer to a new account for a confidential deal deposit and asks that no one else be copied. The message uses a lookalike address. The operations lead has authority to release payments under a threshold and sends the funds without calling the CEO. A control such as a callback to a known number, or a second approver, would likely have stopped it. The insurance question afterward is whether the policy responds to a voluntarily sent payment, and whether a required verification step was performed.
What to watch for
- Requests to change bank details, especially with urgency or a request to keep it confidential.
- Sender addresses or web domains with small spelling differences from the real ones.
- Payment requests that bypass the normal approval process.
Guidance from the FBI and FinCEN includes verifying payment changes through a separate communication channel, using two-factor authentication on email accounts, and reporting suspected fraud to the FBI's IC3 quickly. FinCEN's advisory asks victims to report within 24 hours where possible to support any recovery effort.
How insurance may respond
There is no single BEC policy. A loss may be addressed under a cyber liability policy, a crime policy, or an endorsement for social engineering fraud, and these often carry lower sublimits and verification conditions. Reading the exact wording matters. See our crime and fidelity and cyber coverage pages for general background.
Why it matters for technology, AI, fintech and digital-asset companies
Companies that move money often, pay many vendors, or handle customer funds present frequent opportunities for a fraudulent instruction to look routine. Because the FBI has seen funds routed to cryptocurrency exchanges and peer-to-peer platforms, payment controls belong wherever funds move, not only on wires.
Practical controls that are commonly recommended
These steps lower risk but do not eliminate it:
- Confirm any change to bank details by calling a known number, not by replying to the email.
- Require two approvers above an agreed payment threshold.
- Turn on multi-factor authentication for email accounts.
- Watch for lookalike domains and unusual forwarding rules in mailboxes.
- Give staff a safe way to pause and escalate an urgent or confidential payment request.
Insurers may ask about these controls during underwriting, and some policies make a verification step a condition of coverage.
Questions to ask your broker or underwriter
- Does a cyber policy, a crime policy or both respond to fraudulent payment instructions, and at what sublimit?
- Does the policy require a verification step, such as a callback, as a condition of coverage?
- Does the definition of money or funds include digital assets, or only traditional currency and securities?
- Does it cover impersonation of customers, vendors and executives, and does it address both a compromised email account and a spoofed one?
- What are the retention and the deadline for notifying the insurer, and how does a claims-made reporting requirement apply?
- How does the policy relate to first-party coverage for funds the company sent, and which exclusions could apply?
Common mistakes
- Verifying a payment change by replying to the same email thread.
- Relying on a single approver for urgent or confidential payments.
- Assuming cyber insurance and crime insurance overlap completely. Each may carry its own limits, exclusions and conditions.
- Waiting too long to act. Guidance from the FBI and FinCEN stresses reporting quickly, and policies often have notice requirements.
- Treating a low social engineering sublimit as full coverage for a large wire.
How BEC shows up for fast-growing companies
Fundraising closings, vendor payments and customer fund movements can all produce wire instructions that look routine, and companies with lean finance teams often have fewer approval layers. Companies that move money or digital assets, as described on our fintech and digital assets and crypto pages, face the added question of whether a fraudulent transfer of a digital asset counts as covered "money" under the policy. See startup insurance by stage for how coverage tends to grow with the company.
See how this applies in practice: fidelity and crime insurance and tech E&O and cyber insurance.
Related terms
Frequently asked questions
What is business email compromise (BEC)?
Business email compromise (BEC) is a fraud in which a criminal compromises or impersonates a legitimate email account, posing as an executive, vendor or colleague, to trick someone into sending money or sensitive information. It is a type of scheme, not an insurance product, so whether a loss is covered depends on the policy.
Is business email compromise covered by cyber insurance?
It depends on the policy. Some cyber policies include limited impersonation or funds transfer fraud coverage, and some crime policies add it by endorsement. Sublimits and callback verification conditions are common, so a loss may be partly covered, or not covered, depending on the wording.
How is BEC different from phishing?
Phishing is a broad tactic of luring people into giving up credentials or clicking something harmful. BEC is the targeted payment or data fraud that often follows, using a compromised or spoofed account. Phishing is one common way criminals gain access to the email account first.
How can a company reduce its BEC risk?
Common steps include two-factor authentication on email, confirming any change in payment details through a separate channel such as a known phone number, requiring a second approver for wires, and training staff on lookalike domains. These reduce risk but do not remove it.
What should a company do right after discovering a BEC payment?
Contact the bank immediately to ask about recalling the transfer, report the incident to law enforcement such as the FBI's IC3, and notify your broker and insurer under the policy's notice terms. Preserve the emails and account logs. Speed matters for any chance of recovery.
Can money lost to business email compromise be recovered?
Sometimes, especially when the bank and authorities are contacted quickly, but recovery is never guaranteed. FinCEN has asked victims to report promptly to support recovery efforts, so a fast response is the most useful step.
Does crime insurance cover business email compromise?
It may, depending on the form. Some crime policies include funds-transfer or social engineering fraud coverage, often with a sublimit. Many exclude payments the insured voluntarily makes unless an endorsement adds coverage, so read the wording.
Who is targeted by business email compromise?
Any organization or individual that makes legitimate payments can be targeted, according to the FBI and FinCEN. Companies that pay many vendors or move customer funds often have more opportunities for a fraudulent instruction to look routine.
Need this coverage, or just a clear answer?
Our brokers translate terms like Business Email Compromise (BEC) into a program built for how your company actually operates, and read every policy for the exclusions that matter.
Book a consultation → (opens in a new tab)