Key Takeaways
- Risk to your company: one convincing email can send a supplier payment or payroll file to a criminal, and funds are hard to recover once they move onward.
- Business email compromise (BEC) is a scam where criminals pose as your boss, a colleague or a supplier to make staff pay money or send sensitive data.
- It usually carries no link or malware, so spam filters often miss it; your payment process is the real defence.
- The FBI recorded about US$3.05 billion in BEC losses in 2025, second only to investment fraud.
- If money has gone, call your bank and the police Anti-Scam Helpline 18222 at once; speed matters most.
It is 5:40pm on a Friday. Your accounts clerk receives an email from the managing director, from what looks like his usual address: a supplier deal must close tonight, please wire HK$480,000 to a new account, and keep it quiet until Monday.
What is business email compromise (BEC)?
Business email compromise (BEC) is a fraud in which a criminal impersonates someone your staff trust, usually a boss, colleague, supplier or lawyer, through a fake or hijacked mailbox, to persuade them to transfer money, change bank details or send sensitive data. It relies on deception and timing, not malicious software.
Think of it as a forged letter on genuine letterhead. The envelope looks right, the tone sounds right, and the request arrives at a believable moment, such as quarter-end or just before a holiday.
BEC is a targeted form of phishing. Instead of thousands of identical messages, the criminal writes one researched email to one person who can approve a payment.
A Hong Kong example: police said in April 2026 that a company manager received an email from someone posing as the chief executive and transferred more than HK$14 million to a local bank account. Only after contacting the real CEO did the manager learn his mailbox had been hacked (RTHK, 27 April 2026).
How does business email compromise work?
Most BEC attacks follow five steps: research the company, gain a foothold through a stolen password or look-alike domain, watch email traffic quietly, strike with an urgent payment or data request at the right moment, then move the money through mule accounts within hours. Each step is low-tech but patient.
- Research: names, job titles, suppliers and travel plans from the company website, LinkedIn and press releases.
- Foothold: a phished Microsoft 365 or Google password, or a domain such as abc-trading.co registered to imitate abctrading.com.
- Watch: hidden inbox rules forward or delete replies so the real owner sees nothing unusual.
- Strike: an urgent instruction, often late on a Friday or while the boss is flying.
- Cash out: funds pass through local mule accounts, which is why Hong Kong cases often end in money-laundering arrests.
AI now speeds up the research and the writing. In September 2026 Microsoft disrupted EvilTokens, a crime-as-a-service platform that combined device-code phishing with AI analysis of stolen mailboxes, studying contacts, payment processes and job roles. It was linked to more than 12,000 inboxes at over 10,000 organisations (Microsoft, 22 September 2026).
What are the main types of business email compromise?
There are five common types: CEO fraud, where a fake executive orders a transfer; fake supplier invoices or changed bank details; takeover of a real employee's mailbox; impersonation of lawyers or auditors during a deal; and data theft, such as requests for payroll or tax records. Supplier fraud is usually the hardest to spot.
Every route in, not just the famous one
- Look-alike domains: one changed letter, an extra hyphen or a different ending (.co instead of .com).
- Display-name spoofing: the name shows your CEO, but the address behind it is a free webmail account.
- Stolen passwords: a phishing page captures a real login, and the criminal emails from the genuine account.
- Device-code or consent phishing: the victim approves a sign-in on a real Microsoft or Google page, handing over access without ever typing a password into a fake site.
- Compromised suppliers: the email genuinely comes from your supplier's mailbox, so every technical check passes.
- Follow-up calls: a cloned voice or deepfake video call to 'confirm' the instruction.
How can you spot a business email compromise attempt?
Watch for a payment or data request that combines urgency, secrecy and a change to normal process: new bank details, a request to skip approval, a sender address that differs by one character, an unfamiliar reply-to address, or a boss who suddenly cannot take a call. One red flag is enough reason to pause.
- The bank account is new, overseas, or held in a personal name rather than the supplier's company name.
- The message stresses confidentiality: do not tell anyone until the deal is announced.
- Hitting reply shows a different address from the one displayed.
Impersonation is no longer limited to email. HKCERT recorded 4,404 security incidents in Q3 2026, 61% of them phishing, and found that attackers increasingly combine email, instant messaging, SMS and phone calls (HKCERT, 5 November 2026).
How can you prevent business email compromise?
Prevention rests on two layers. People and process: verify every new or changed bank detail by calling a number you already hold, and require two approvers for large transfers. Technology: phishing-resistant multi-factor authentication on every mailbox, email authentication records, and alerts whenever a new forwarding rule appears.
For individuals: turn on two-step verification (menu paths last checked November 2026)
- Google account on iPhone: Gmail app → tap your profile picture → Manage your Google Account → Security & sign-in → Turn on 2-Step Verification.
- Google account on Android: Settings → Google → Manage your Google Account → Security & sign-in → Turn on 2-Step Verification.
- Microsoft 365 work account (iPhone and Android): install Microsoft Authenticator → tap + → Work or school account → Scan QR code, using the code shown at mysignins.microsoft.com/security-info → Add sign-in method.
- Never read out or forward a verification code, and never approve a sign-in prompt you did not start.
For SMEs and IT teams
- Publish SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting and Conformance) records, so mail servers can reject email that fakes your exact domain.
- Tag external emails with a visible banner and block automatic forwarding to outside addresses.
- Alert on new inbox rules and sign-ins from unusual countries; review them weekly.
- Move finance and executive accounts to phishing-resistant MFA such as passkeys or security keys, as HKCERT recommends for high-risk accounts.
A company scenario and the rule that stops it
Company rule: no payment to a new or changed bank account until someone calls the payee on a number already on file, and no single person can release a large transfer alone. Set the threshold that fits your business.
Staff notice you can paste into a WhatsApp group
Reminder from management: we will NEVER ask you to make an urgent or secret transfer by email or WhatsApp.
Any new or changed bank details must be confirmed by phone, using the number in our system, not the one in the message.
If a request from me or a supplier feels rushed, stop and call. You will never be blamed for checking.
Suspicious email? Forward it to IT and do not reply.60-second self-check
- Does every mailbox in the company have MFA switched on?
- Do bank-detail changes require a call-back to a known number?
- Do large transfers need two approvers?
- Has anyone checked for unknown forwarding rules this month?
- Do staff know who to call the moment they suspect a fake?
What should you do if you fall for business email compromise?
Act within minutes: call your bank to stop or recall the transfer, report to the police through the Anti-Scam Helpline 18222 or the nearest station, reset the compromised mailbox password and sign out all sessions, remove unknown forwarding rules, and keep the original emails. Then warn suppliers and clients who may receive follow-up fakes.
- Bank first: ask for an urgent recall and give the receiving account number; every hour counts.
- Police: call the Anti-Deception Coordination Centre's 24-hour Anti-Scam Helpline 18222, or 999 in an emergency, and file a report.
- Check accounts: search the payee's account or email on the police Scameter to see if it has been reported before.
- Technical help: HKCERT's hotline 8105 6060 can advise on cleaning up a compromised mailbox.
- Evidence: save the emails with full headers, sign-in logs and bank records before anyone deletes them.
- Personal data: if staff or customer data was exposed, assess whether to notify the Office of the Privacy Commissioner for Personal Data (PCPD) and the people affected.
What is the difference between BEC and phishing?
Phishing casts a wide net with links or attachments to steal passwords or install malware. BEC is a targeted conversation that usually contains no link at all and asks one specific person to pay or send data. Phishing is often the first step that gives criminals a mailbox; BEC is how they cash it in.
Make the payment process your strongest control
Business email compromise succeeds because it looks like ordinary work. Filters and authentication records help, but the control that stops the money leaving is simple: a call-back to a known number and a second approver for every unusual payment.
Find out whether your team would spot a fake boss email
A realistic phishing email test shows which staff would act on a fake payment request, and short awareness training closes the gap before a real attacker tries.
Frequently Asked Questions
Can banks recover money lost to business email compromise?
Sometimes, if you report within hours. Banks can try to freeze or recall funds while they remain in the receiving account, but money moved onward through mule accounts is much harder to trace. Call your bank first, then the police.
Is BEC only an email problem?
No. HKCERT's Q3 2026 review found impersonation spreading across instant messaging, SMS, social media and phone calls, so the same call-back rule should apply to any channel that asks for money.
How much does business email compromise cost businesses?
The FBI's 2025 Internet Crime Report recorded 24,768 BEC complaints with about US$3.05 billion in losses, roughly 10% more than in 2024, making it the second costliest crime type it tracks.