Business Email Compromise Resources

What is Business Email Compromise?

From a regulatory perspective, Business Email Compromise (also known as Email Account Compromise or EAC) is a form of wire fraud, identity theft, and corporate cybercrime. Unlike standard spam or broad phishing attacks that rely on malicious attachments, BEC relies primarily on social engineering, email spoofing, and account takeover tactics to manipulate employees into voluntarily executing fraudulent transactions. Federal authorities like the FBI, USSS, and FTC classify BEC as one of the most financially destructive categories of cybercrime impacting commercial organizations.

How It Manifests

BEC schemes are highly targeted, methodical, and typically unfold in distinct stages:

• Executive Impersonation (“CEO Fraud”): Scammers spoof or hack an executive’s email account and send urgent, confidential payment requests to finance personnel, instructing them to wire funds to foreign or fraudulent accounts.

• Vendor Email Compromise & Fake Invoices: Attackers infiltrate a legitimate vendor’s email system or set up lookalike domains to send updated, fraudulent bank wiring instructions for ongoing corporate contracts.

• Attorney & Professional Impersonation: Perpetrators pose as external legal counsel or auditors handling sensitive corporate transactions (e.g., secret mergers or acquisitions) to pressure targets into making rapid wire transfers.

• Payroll & Data Theft: Attackers request HR or payroll departments to change direct deposit details for executive salaries or demand W-2 tax forms containing employees’ Personally Identifiable Information (PII).

Who Is Impacted?

• Businesses & Corporations: Companies of all sizes—ranging from small businesses to Fortune 500 enterprises—suffer massive direct financial losses from fraudulent wire transfers.

• Financial Institutions & Escrow Services: Banks, title companies, and payment processors face operational disruptions, liability claims, and freeze orders during recovery attempts.

• Employees & Consumers: Employees whose PII is exposed in data-focused BEC attacks face identity theft, while home buyers or clients making large real estate/escrow transfers often lose life savings to spoofed closing instructions.

Consequences from Regulators

Participation in or failure to prevent BEC carries severe legal, regulatory, and financial repercussions enforced by agencies like the FBI, U.S. Secret Service (USSS), Federal Trade Commission (FTC), and SEC:

• Criminal Prosecution (DOJ / FBI / USSS): Orchestrators and co-conspirators (including money mules) face federal felony charges for wire fraud, bank fraud, money laundering, and computer fraud (CFAA). Penalties include restitution orders and up to 20 to 30 years in federal prison per count.

• Regulatory Penalties for Inadequate Security (SEC / FTC): Public companies or financial institutions that fall victim to BEC due to deficient internal controls face regulatory enforcement. The SEC charges firms for failure to maintain adequate internal accounting controls under Section 13(b)(2)(B) of the Exchange Act, resulting in multi-million-dollar civil penalties.

• Data Breach & Privacy Liability: If BEC leads to compromised employee or customer data, state Attorneys General and FTC regulators enforce substantial civil fines for failure to safeguard sensitive financial or personal records.

• Clawback & Asset Forfeiture: Federal law enforcement works alongside international counterparts to seize fraudulent accounts, freeze assets, and execute forfeiture orders on illegal gains.