Business Email Compromise
A compromised or spoofed email from your CEO or a trusted vendor requests an urgent wire transfer. It's the #1 cause of corporate fraud losses worldwide — the FBI estimates over $50 billion lost since 2013.
How it worksThe anatomy of the scam
Every case follows roughly the same playbook. Recognize the pattern, stop it early.
1. Reconnaissance
Attackers study your company's public org chart, vendor relationships, and email patterns (often from LinkedIn).
2. Account compromise or spoofing
They either hack a real executive's email via phishing or register a lookalike domain (acme-inc.co instead of acme-inc.com).
3. The urgent request
'Hi, I'm about to board a flight — I need you to wire $87,000 to this new vendor today. Confidential, don't loop in anyone else.'
4. New banking details
Legitimate vendor suddenly sends 'updated wiring instructions' — but they're from the attacker's lookalike domain.
5. The wire, gone in minutes
Recovery is nearly impossible once funds hit the receiving account.
Warning signsRed flags to watch for
If you're seeing two or more of these, assume it's a scam until proven otherwise.
Urgency + secrecy
'Don't tell anyone' is never a real executive instruction.
Slightly-off email address
One character different from the real domain.
New wiring instructions via email alone
Never trust banking changes received only by email.
Request to buy gift cards
CEOs never ask employees to buy Apple gift cards.
Protect yourselfDo this. Not that.
✓ Do
Verify any wire or banking change by calling the requester at a known number — not one in the email.
✗ Don't
Never wire funds based on an email alone — even if it looks legitimate.
✓ Do
Enforce dual approval for wires above a set threshold.
✗ Don't
Don't skip verification because the email sounds urgent. Urgency is the tell.
RelatedIf this happened to you, also check
Has this happened to you?
Your story could stop the next person from losing their savings. Submit anonymously in about two minutes.