Cybersecurity · Email fraud
BEC cost U.S. victims about $3 billion in 2025. Most of it is preventable with a written payment rule and a handful of email settings.
FBI’s 2025 BEC loss figures
A payment rule that stops fraud
Email settings that block impostors
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
Business email compromise (BEC) is fraud in which a criminal uses a hacked or spoofed email account to trick someone into sending money or sensitive data. The most effective prevention is a written payment verification rule: any new or changed bank details, and any urgent payment request, are confirmed by phone using a number you already have, never one in the email. Back that up with multi-factor authentication (MFA), DMARC email authentication, blocked auto-forwarding and impersonation protection.
The stakes are high. The FBI’s 2025 Internet Crime Report recorded 24,768 BEC complaints with about $3.05 billion in reported losses, the second-largest loss category after investment fraud.
BEC rarely involves malware. The attacker simply gets into, or imitates, a trusted mailbox and asks for money in a believable way. The FBI describes criminals compromising legitimate accounts through social engineering or intrusion, then using them to request transfers. Common versions:
A supplier’s mailbox is hacked. The attacker replies inside a real invoice thread with “new bank details.” Because the thread is genuine, nobody questions it.
An email that appears to come from the owner or CFO asks for an urgent wire, gift cards or a confidential payment, often while the executive is traveling.
HR receives a request, apparently from an employee, to change their direct deposit account before the next payroll run.
Title companies, law firms and buyers get altered wiring instructions days before a real estate closing or settlement.
Attackers often watch a hacked mailbox for weeks, learning who approves payments, how invoices look and when people are away. They set up inbox rules so replies go to a hidden folder. Some register lookalike domains, such as one letter changed in your vendor’s name.
BEC emails are usually well written and free of obvious mistakes, so look for context rather than typos.
One of these on its own is a reason to pick up the phone. Two together should stop the payment until verified. The FBI’s own advice is to verify any account change through a separate channel and to check that sender addresses match the organization they claim to represent.
Technology helps, but process stops the money. Write these rules down and get every person who touches payments to follow them.
Not sure how exposed your email and payments are? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your cybersecurity, applications and business continuity, including email security and access controls, with the next steps in order. It is yours to keep, with no obligation. Book your assessment.
Our Microsoft 365 security settings guide shows where most of these live.
General phishing training is useful, but BEC targets a few roles: owners, bookkeepers, accounts payable, HR and anyone who handles closings. Give them specific, short training:
This is general information; confirm coverage questions with your insurer. JLB USA’s cybersecurity services include email security, MFA and access reviews for businesses with about 25 to 100 employees.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
A written rule that every new or changed bank detail is verified by phone using a known number, combined with MFA on every mailbox and DMARC on your domain.
The FBI’s 2025 Internet Crime Report recorded about $3.05 billion in BEC losses from 24,768 complaints, an average of over $120,000 per complaint.
It stops many account takeovers, but not spoofed or lookalike domains, or a hacked vendor mailbox. Payment verification is still needed.
Some policies cover social engineering or funds transfer fraud, often with sublimits and conditions such as call-back verification. Check your policy wording with your insurer or broker.
