Business email compromise for small business is one of the most expensive scams around, and it rarely looks like a scam. There is no strange attachment and no obvious virus. There is just an email that appears to come from your boss, a vendor you pay every month, or a client you trust, asking you to do something that seems perfectly routine. Update the bank account on an invoice. Send a wire today. Buy gift cards and keep it quiet for now.
If you own, manage, or help lead a business, this is a risk worth understanding. This guide explains what business email compromise is, why smaller companies are such attractive targets, and six practical steps that make these scams far harder to pull off.
Key Takeaways
- Business email compromise (BEC) is fraud that uses email impersonation or a hijacked email account to trick someone into sending money or sensitive information.
- The FBI’s Internet Crime Complaint Center received 24,768 BEC complaints in 2025, with reported losses of more than $3 billion.
- Most of the defense is process, not technology: verify every payment change with a phone call to a number you already have.
- Multi-factor authentication, payment approval rules, and email protections close the most common doors.
- If money has been sent, call your bank right away and file a report at ic3.gov.
What Is Business Email Compromise?
Business email compromise, often shortened to BEC, is a type of fraud where a criminal uses email to impersonate someone you trust, or takes over a real email account, in order to redirect money or collect sensitive information. The FBI describes it as compromising email accounts and other forms of communication through social engineering or computer intrusion in order to make unauthorized fund transfers.
The key word is trust. A BEC message does not need to defeat your security software. It only needs to look believable to a busy person. That is why the scam works on capable, careful people, and why business email compromise for small business is as much a business process problem as a technology one.
BEC tends to show up in a few familiar forms:
Why Business Email Compromise Hits Small Business Hard
The numbers show the scale of the problem. According to the FBI’s 2025 Internet Crime Report, the Internet Crime Complaint Center logged 24,768 BEC complaints and $3,046,598,558 in reported losses in 2025. BEC was the second-largest loss category in the entire report, behind only investment fraud.
Those figures count only the incidents that were reported, so the true picture is likely larger. What matters for a small business is the pattern behind them.
Smaller organizations often make an attractive target for a few understandable reasons. Payments are frequently approved by one or two people. Finance and operations teams are lean, so there is little time to double check a request. Email is the main way business gets done, which makes a fake message blend in. And there is rarely a written rule about how a change in payment details should be confirmed.
For firms that handle large transactions, trust accounts, closings, or client funds, such as law firms, architects, and construction companies, a single successful scam can move a very large amount of money in one transaction. The FBI’s report itself describes cases where a compromised email account led to fraudulent wire instructions during a real estate closing.
AI Is Making These Emails More Convincing
It used to be easy to spot a scam email by its awkward wording. That is changing. The FBI report notes that chat generators can quickly create official-sounding emails that mimic a company’s CEO, and that voice cloning can be used to request wire payments. The report logged 135 BEC complaints involving AI, with more than $30 million in reported losses.
That does not mean you need to fear every message. It means the old advice to look for typos is no longer enough on its own. The more reliable defense against business email compromise for small business is a habit: confirm any request involving money through a second channel, no matter how polished the email looks.
6 Simple Steps to Protect Your Business
1. Turn on multi-factor authentication for every email account
Many BEC attacks begin when a criminal logs in to a real mailbox using a stolen password. Multi-factor authentication adds a second check, such as an approval on a phone, so a stolen password alone is not enough. Make it a requirement for every employee, not just leadership. If you want a closer look at how to roll it out well, see our guide to multi-factor authentication for small business.
2. Verify payment changes with a phone call
This single habit is one of the most effective defenses against business email compromise for small business, especially vendor and invoice fraud. Whenever a vendor, client, or employee asks to change bank details, call them using a phone number you already have on file, never a number from the email itself. Make this a written rule, and make sure no one feels awkward about following it.
3. Require two people for payments and changes
Set a clear approval process for wires, new payees, and changes to existing payment details. One person requests, a second person approves. A fake request from “the boss” has far less power when the process requires a second set of eyes.
4. Add email protections that flag impersonation
Your email system can do more of the work. Authentication settings known as SPF, DKIM, and DMARC help prevent criminals from sending email that falsely appears to come from your own domain. Warning banners on messages from outside your organization, and alerts for look-alike domains and suspicious forwarding rules, add another layer. These are settings your IT provider can configure and monitor for you.
5. Train your team on the warning signs
Teach people to pause when a message combines money with pressure. The most common red flags are listed in the checklist below. A short, regular reminder works better than a once-a-year lecture, and the goal is confidence, not fear. Employees should know that questioning an unusual request is always welcome.
6. Watch for signs that an account has been taken over
A hijacked mailbox often carries quiet clues: new forwarding rules the owner did not create, login attempts from unfamiliar locations, or messages in the sent folder nobody recognizes. Monitoring for these signals helps catch a problem before it turns into a fraudulent payment. Stolen credentials also play a big role in account takeover, which is why dark web monitoring for small business is a useful companion to the steps above.
What to Do If You Think You Have Been Targeted
Speed matters when business email compromise for small business turns into a real loss. The FBI’s guidance in its 2025 report is to contact your financial institution immediately and request a recall of the funds, and to file a complaint at ic3.gov regardless of the amount lost. Beyond that, a few practical steps help:
- Call your bank right away and ask them to attempt a recall of the transfer.
- Contact your IT provider so they can check the affected mailbox, reset credentials, and look for rules or access the criminal may have set up.
- File a report at ic3.gov.
- Notify the people and companies who may be affected, so they do not act on further fake messages.
- Write down what happened while it is fresh, including who was involved and when.
Having a plan in advance takes pressure off in the moment. Pairing it with a good ransomware response plan helps too, and our guide to ransomware protection for small business covers what to do in the first hour of an incident.
How Courant Can Help
Business email compromise for small business works because it targets people and processes as much as technology, so protecting your business takes a combination of the two. At Courant, we help New Orleans area businesses set up the email protections, multi-factor authentication, and monitoring described above, and we help teams build simple payment verification habits that fit how they already work.
Frequently Asked Questions
What is business email compromise?
Business email compromise is a scam in which a criminal impersonates a trusted person or takes over a real email account to trick someone into sending money or sensitive information. It is often shortened to BEC.
How is BEC different from regular phishing?
Traditional phishing usually tries to get you to click a link or open an attachment. BEC often has neither. It relies on a believable request, such as changing payment details, which makes it harder for security software to catch and more dependent on good business processes.
Is business email compromise for small business really a risk?
Yes. The FBI’s 2025 Internet Crime Report recorded 24,768 BEC complaints and more than $3 billion in reported losses across organizations of all sizes. Smaller companies often have fewer approval steps, which can make a convincing request easier to act on.
Can multi-factor authentication stop business email compromise?
It helps a great deal against account takeover, where a criminal logs in using a stolen password. It does not stop a scam that uses a look-alike email address, which is why payment verification steps matter as well.
What should I do if I sent money to a scammer?
Contact your bank immediately to request a recall of the funds, and file a complaint at ic3.gov. Then contact your IT provider so the affected account can be reviewed and secured.
Getting Help With Business Email Compromise for Small Business
Business email compromise for small business does not have to be a matter of luck. A few clear rules, the right email protections, and a team that feels comfortable pausing to verify can close the doors these scammers rely on.
If you would like help reviewing your email security and payment processes, schedule a 15-minute consultation to talk about business email compromise for small business, or contact us with your questions. We will help you find the gaps these scams depend on.
