Business email compromise (CEO fraud)

BEC is a payment-fraud scheme that uses email as its channel, not a malware technique. The FBI's taxonomy distinguishes CEO fraud (an executive orders an urgent transfer), bogus-invoice or supplier schemes, compromise of an employee's own mailbox to bill that employee's customers, attorney impersonation around confidential deals, and data theft such as payroll or tax records as a precursor. In the IC3 2025 annual report BEC was the second-largest cyber-enabled fraud category by loss, with USD 3,046,598,558 reported, behind only investment fraud; the figure covers complaints filed with IC3, so real losses are higher.

Two technical variants dominate. In the spoofing variant the attacker never gets into any mailbox: a lookalike domain (an extra letter, a different TLD, a homoglyph), a display name that matches the executive over a free-mail address, or a Reply-To header that silently diverts the answer. Sender authentication addresses part of this - SPF (RFC 7208) and DKIM (RFC 6376), aligned under a DMARC policy of p=reject (RFC 7489), stop exact-domain spoofing of your own domain, but do nothing against a lookalike domain that has its own valid DMARC records. In the account-takeover variant, credentials or session tokens are stolen through phishing, often via adversary-in-the-middle kits that defeat OTP and push MFA. The attacker then reads the thread history, waits for a real invoice cycle and creates inbox rules that forward, move or delete replies containing words like invoice or payment (MITRE ATT&CK T1114.003 and T1564.008). Vendor email compromise is the same pattern run from a supplier's mailbox, so the fraudulent message genuinely comes from the trusted domain and passes every authentication check.

Because the payload is a request, not a file, content filters struggle and the decisive controls are procedural: changes to bank details verified by a call-back to a number already on file (never one given in the message), four-eyes approval above a threshold, cooling-off periods for new payees, and a policy that executives never order payments by email alone. Technical support comes from banner tags on external mail, lookalike-domain monitoring, alerts on new forwarding rules and impossible-travel sign-ins, and phishing-resistant MFA (FIDO2/WebAuthn) to block the takeover path.

Recovery is a race against settlement. Transfers should be recalled through the bank immediately; the FBI's Financial Fraud Kill Chain, run by the IC3 Recovery Asset Team since 2018, reported 3,900 initiated incidents in 2025 with about 58 percent of attempted theft frozen. In Denmark the case is bedrageri under straffeloven § 279 and is reported to the police; if the compromised mailbox held personal data, it may also be a personal data breach notifiable to Datatilsynet within 72 hours under GDPR Art. 33(1).