Business email compromise (BEC)

BEC doesn't need malware. Criminals either break into a real mailbox (often through phishing) or send from a look-alike address, then use the trust that comes with it. Common versions: a fake “new bank details” email from a vendor, the “owner” asking the office manager to buy gift cards, a payroll change request redirecting an employee's paycheck, or a fake closing-instructions email in a real estate deal.

Account takeovers are especially dangerous because the attacker reads real conversations first. They wait for an actual invoice, then reply in the same thread with changed payment details. They often add hidden inbox rules that move replies out of sight, so the real account owner doesn't notice.

Why it matters: the FBI's Internet Crime Complaint Center (IC3) has ranked BEC among the costliest types of cybercrime it tracks for years running. For a small business or practice, a single redirected payment can be unrecoverable once the money is moved. CPA firms are a particular target, because they handle client payments and tax data.

Prevention combines technology and process. On the technology side: MFA and conditional access to stop account takeover, DMARC to stop spoofing of your own domain, and alerts on suspicious inbox rules. On the process side: a firm rule that any change to payment details is confirmed by phone, using a number you already have — never one in the email.

Example: a CPA firm receives a client's email asking to send a refund to a new account. The bookkeeper follows the firm's callback policy, phones the client on the number in the file, and learns the client's mailbox had been hacked. The money never leaves.

Learn more in our phishing and BEC guide.