How organizations combat business email compromise

September 22, 2025 | 4 minute read

Educate employees to exercise skepticism when receiving unusual email requests, even when the email appears to come from a known of trusted contact.
Encourage employees not to bypass identity access controls or share login credentials.
Remember that fraudulent emails and email scams may be the first step in complex cybercrime campaigns, such as ransomware or data theft.

Business email compromise (BEC) is a specialized phishing technique that targets individuals with the intent of tricking them into sending money or sharing sensitive information. It remains one of the most lucrative types of cybercrime, with losses exceeding $3 billion across nearly 25,000 complaints reported to the FBI in 2025.¹

The methods perpetrators use in BEC continue to change as technology and business processes evolve. But this crime still depends on establishing and exploiting trust. Perpetrators may impersonate internal colleagues, senior leadership, or trusted consultants, as well as established vendors or customers. They use persuasive social engineering tactics to convince individuals of their identity and the legitimacy of their requests.

Ongoing developments in artificial intelligence (AI) and account hacking have made some BEC scams very difficult to detect. The best defense is still a workforce that stays alert to this persistent threat while balancing efficiency with security objectives.

Criminals often tailor their BEC scams to the organization and individuals they target by adding highly specific details based on internet research. However, most scams fall into these broad categories:

Invoice and payment scams. Criminals impersonate a vendor or customer and request payment for an outstanding invoice or ask that future payments be redirected to a new account. The email may contain a malicious link or attachment that directs the recipient to a phishing site or prompts them to download malware.

Urgent request from a supervisor. An employee receives an email that appears to be from their supervisor or a senior executive, urging them to quickly send a gift or payment. In some cases, the scammer may first ask to switch to text messaging or video conferencing before making the request. They may also use AI-generated text or video to make the interaction seem more convincing.

Whaling. A targeted campaign that focuses on high-level executives to achieve financial gain, steal sensitive data or damage the reputation of the individual or organization. These attacks often begin with business email compromise (BEC) tactics.

Data requests/theft. Scammers may request personally identifiable information (PII) from employees or customers to use in subsequent financial scams.

Commodities requests/theft. Scammers pose as purchasing departments for established vendors, make large purchases on credit and arrange for shipment of goods that are never paid for.

Whatever the method, criminals count on recipients being fooled or missing signs that something about the email is unusual. This is the point where the social engineering — or coercion — begins.

As with every type of cybercrime, there is no absolute defense against BEC. A combination of tools, enforced policies and employee engagement can minimize the risks. Specific defenses can include:

Investing in strong email gateway controls. This includes advanced filtering, authentication, and encryption for inbound mail to help detect spoofed domains and anomalous communications. Organizations should also implement domain-based message authentication, reporting, and conformance (DMARC) to protect against spoofing and consider brand indicators for message identification (BIMI) to help recipients recognize authentic emails in supported environments. Note: While these controls help reduce spoofing, they do not prevent direct account takeover.

Deploying and maintaining strong identity access and account privilege management. Identity and access management (IAM) and privileged access management (PAM) are methods that make it more difficult for unauthorized users to exploit stolen credentials to initiate BEC attempts. Used in conjunction with multifactor authentication (MFA) or biometrics, these protections can be effective assuming organizations don’t set and forget them. Review and enforcement of these policies is critical.

Redundant payment approvals. Anomalous requests or changes to payment information should require extra layers of review and approval.

Employee training and awareness. Any successful BEC attempt depends on eluding controls or deceiving an employee. Organizations should regularly train all employees (especially employees responsible for accounts payable and receivables) and make BEC and cyberthreat awareness part of company culture.

BEC is likely to persist in an environment that depends on speed, convenience and friction-free transactions between vendors and customers and partner organizations. A strong defense depends on encouraging employees to slow down when something about an email feels unusual. “Trust but verify” remains a critical principle for maintaining strong cybersecurity practices and sound business outcomes.

¹Federal Bureau of Investigation, Internet Crime Report 2025

Back to Homepage

Explore more

Phishing. Vishing. Smishing. Keeping up with threats from scams, fraud and cyberattacks is difficult. Our resources and insights can help you protect your company and customers.

Learn about common red flags that can help you spot a scam before it’s too late.

5-minute read

Important Disclosures and Information

Bank of America, Merrill, their affiliates and advisors do not provide legal, tax or accounting advice. Consult your own legal and/or tax advisors before making any financial decisions. Any informational materials provided are for your discussion or review purposes only. The content on the Center for Business Empowerment (including, without limitations, third party and any Bank of America content) is provided “as is” and carries no express or implied warranties, or promise or guaranty of success. Bank of America does not warrant or guarantee the accuracy, reliability, completeness, usefulness, non-infringement of intellectual property rights, or quality of any content, regardless of who originates that content, and disclaims the same to the extent allowable by law. All third party trademarks, service marks, trade names and logos referenced in this material are the property of their respective owners. Bank of America does not deliver and is not responsible for the products, services or performance of any third party.

Not all materials on the Center for Business Empowerment will be available in Spanish.

Certain links may direct you away from Bank of America to unaffiliated sites. Bank of America has not been involved in the preparation of the content supplied at unaffiliated sites and does not guarantee or assume any responsibility for their content. When you visit these sites, you are agreeing to all of their terms of use, including their privacy and security policies.

Credit cards, credit lines and loans are subject to credit approval and creditworthiness. Some restrictions may apply.

Merrill Lynch, Pierce, Fenner & Smith Incorporated (also referred to as “MLPF&S” or “Merrill”) makes available certain investment products sponsored, managed, distributed or provided by companies that are affiliates of Bank of America Corporation (“BofA Corp.”). MLPF&S is a registered broker-dealer, registered investment adviser, Member SIPC, and a wholly owned subsidiary of BofA Corp.

Banking products are provided by Bank of America, N.A., and affiliated banks, Members FDIC, and wholly owned subsidiaries of BofA Corp.

“Bank of America” and “BofA Securities” are the marketing names used by the Global Banking and Global Markets division of Bank of America Corporation. Lending, derivatives, other commercial banking activities, and trading in certain financial instruments are performed globally by banking affiliates of Bank of America Corporation, including Bank of America, N.A., Member FDIC. Trading in securities and financial instruments, and strategic advisory, and other investment banking activities, are performed globally by investment banking affiliates of Bank of America Corporation (“Investment Banking Affiliates”), including, in the United States, BofA Securities, Inc., which is a registered broker-dealer and Member of SIPC, and, in other jurisdictions, by locally registered entities. BofA Securities, Inc. is a registered futures commission merchant with the CFTC and a member of the NFA.

Investment products:

Are Not FDIC Insured

Are Not Bank Guaranteed

May Lose Value

How organizations combat business email compromise

Key takeaways

Explore more

Security & Information Management

Tips to help spot and avoid a scam: what business owners should know

Important Disclosures and Information

Investment products:

How organizations combat business email compromise

Key takeaways

Common BEC frauds

How to help protect your organization from BEC

Explore more

Security & Information Management

Tips to help spot and avoid a scam: what business owners should know

Important Disclosures and Information

Investment products: