Business Email Compromise 

Share

Latest news on business email compromise (BEC), covering BEC scams, CEO fraud, vendor email compromise, invoice fraud, payment diversion, email account compromise, spear phishing, spoofed emails, fake invoices, wire transfer fraud, account takeover, Microsoft 365 phishing and recovery of stolen funds.

Business email compromise is a scam in which criminals use a hijacked or spoofed business email account to trick staff into sending money or sensitive data. Finance teams, payroll staff and firms that pay suppliers by wire transfer are common targets. The FBI's Internet Crime Complaint Center has warned about it for more than a decade and takes reports from US victims.

The best-known forms are CEO fraud, where a criminal poses as a senior executive, and vendor email compromise, where a supplier's mailbox sends an invoice with changed bank details. Agencies and security firms also warn that AI-generated voice and video can add pressure on victims. In October and November 2025 Interpol's Operation Sentinel led to 574 arrests across Africa, and in Senegal accounts were frozen before a $7.9 million wire transfer left.

Defences are mostly about process. Staff should confirm any change of bank details by calling a known number, and payments can need two approvals. Two-step verification protects mailboxes, while SPF, DKIM and DMARC make it harder to spoof a company's domain. The NCSC offers a free email security check and published guidance on the threat in August 2024.

Victims range from small firms and charities to large companies, and staff can feel blamed when a convincing email slips through. Debate continues over how far banks and email providers should share responsibility for losses. Many experts say training alone is not enough and that technical controls and clear payment rules should back it up.

The FBI's complaint data on the scam goes back to October 2013, and its public warnings date from at least 2015. Over time the tactics have moved from simple spoofed emails to full account takeover, with attackers reading real conversations before they strike. Microsoft 365 accounts are a frequent target of phishing and token-spraying attacks.

Fast news can protect a bank balance. Our NewsNow business email compromise feed gathers the latest headlines on BEC scams, CEO fraud, invoice fraud, account takeover and recovered funds from reliable sources worldwide, so you have a comprehensive, up-to-date view.