Business email compromiseBEC

A scam where a fraudster impersonates an executive or trusted vendor, by email, voice, or now deepfake video, to trick an employee into wiring money or sharing sensitive data.

For example, an employee might get a message that appears to come from the chief financial officer asking for an urgent payment to a new account.

A social-engineering fraud category in which an attacker impersonates a company executive, vendor, or partner, historically via a spoofed or compromised email account, increasingly via synthetic voice or video, to induce an employee to authorize a wire transfer or disclose credentials. Social engineering means manipulating a person, instead of breaking into a system, to get them to take an action.

Business email compromise comes in several familiar forms:

• Executive impersonation, in which a fraudster poses as a senior leader and requests an urgent transfer.
• Vendor or invoice fraud, in which a fraudster poses as a supplier and sends new payment details.
• Account compromise, in which a real employee's email account is taken over and used to send requests.
• Payroll diversion, in which a fraudster poses as an employee and redirects a paycheck.

The attack usually follows a pattern:

1. The attacker researches the company and picks a target who can move money.
2. They send a believable request, often with urgency and secrecy.
3. The employee acts on it, and the money goes to an account the attacker controls.
4. The funds are moved quickly, often through money mules.

Business email compromise sits next to terms that are easy to mix up:

• Synthetic avatar deepfake is a fabricated person on a live video call, which extends the attack beyond email.
• Voice cloning recreates a person's voice for phone-based versions of the scam.
• Phishing is a broader attempt to trick people into giving up information, and it can be the first step of a compromise.

For more, see FinCEN Issues Urgent Alert on Rising Deepfake Fraud Schemes Targeting Financial Institutions.