Business Email Compromise
A targeted fraud where attackers impersonate a CFO or CEO to trick employees into sending unauthorized wire transfers, often using voice cloning or email spoofing to create false urgency.
Business email compromise (BEC) is a targeted cyberattack where unauthorized actors impersonate executives or trusted partners to deceive employees into authorizing fraudulent wire transfers. It typically involves sophisticated social engineering, voice cloning, or email spoofing to create a false sense of urgency or authority, aiming to steal money rather than just gather data.
What this means in real life
An employee receives an email appearing to come from their CEO requesting an urgent wire transfer to a vendor account. The sender address looks correct, but the attacker has spoofed it. The employee processes the transfer without verification, and thousands of dollars are sent to a criminal's account.
What it isn’t
It is not a generic phishing email sent to random recipients. BEC specifically targets known business relationships and often involves research into company structure, pending deals, or financial processes to appear legitimate.
Commonly misused online
People often use 'BEC' interchangeably with all phishing or email fraud, but BEC specifically involves impersonation of a trusted internal or external business contact—not mass spam or generic credential-stealing emails.
Based on 1 reference source, including reference sources. Last verified July 12, 2026.