Business email compromise is financially motivated

No. Business email compromise attacks are typically financially motivated scams, not disruption-motivated attacks. The FBI's Internet Crime Complaint Center defines BEC as a scam targeting people and organizations involved in fund transfers, where account compromise, social engineering, or intrusion leads to an unauthorized transfer of funds. An attack can disrupt operations, but disruption is not the defining objective of BEC.

How business email compromise works

The FBI IC3 definition of BEC focuses on unauthorized fund transfers. The attacker may compromise a legitimate business email account through social engineering or computer intrusion, then use that access to make a payment request look credible.

The fraud often depends on context. In its published BEC scenarios, IC3 explains that attackers can study selected victims, identify people involved in wire transfers, and learn the protocols used inside the business. A phishing message may first collect details such as names or travel dates.

A compromised mailbox can also conceal the fraud. The FBI warned that attackers may configure mailbox rules to delete key messages or enable forwarding to an outside account. They can then impersonate communication between a business and its vendor or customer to redirect pending or future payments to a fraudulent bank account. IC3's cloud-email-services alert describes those account-takeover tactics.

The financial objective is visible in current reporting. The 2025 IC3 Annual Report records 24,768 BEC complaints and about $3.05 billion in reported losses for 2025. These are self-reported complaints to a US federal reporting channel, not measured total losses, and IC3 says its statistics are an assessment at a point in time that may change.

Fortra, reported in the APWG Q1 2026 phishing report, found that observed BEC attempts most often requested gift cards, wire transfers, or payroll diversion. Those figures describe attempted attacks seen in one vendor's telemetry, not confirmed losses.

For broader context on email-borne threats, see Palisade's email security resources and the email threats hub.

When the answer changes

A BEC incident can cause disruption. A diverted supplier payment can delay orders, create accounting work, trigger incident response, and damage a business relationship. Those consequences do not change the core classification of the scam when the attacker is trying to obtain money or payment credentials.

Use this decision rule:

• If the message seeks a payment, altered bank details, payroll change, gift cards, or access that supports a transfer, treat it as potential BEC.
• If the primary objective is to disable systems, destroy data, or interrupt operations without a transfer-fraud request, it may be another type of cyber incident rather than BEC.
• If the evidence is incomplete, pause the transaction and verify the request outside the email thread.

A payment request that arrives with urgency, secrecy, or changed account details should not be approved from email evidence alone.

The FBI recommends using secondary channels or two-factor authentication to verify requests that change account information. Its BEC guidance also says to inspect the actual sender address, especially on mobile devices where address details may be less visible. IC3's protection guidance supports both checks.

DMARC has a narrow but useful role. CISA, NSA, FBI, and MS-ISAC recommend a DMARC policy of reject to protect recipients from emails that impersonate a domain. However, RFC 9989 states that DMARC addresses specific forms of exact-domain spoofing and does not address lookalike domains or display-name abuse. A BEC message sent from a compromised legitimate mailbox or a free webmail account can still pass around that control.

For the distinction between BEC and related terminology, see business email compromise also known as.

Worked example: invoice redirect decision rule

Consider a finance employee who receives a message that appears to continue an existing supplier conversation:

From: supplier-contact@lookalike-example.com
Subject: Updated remittance details
Please use the new account details for the invoice due today.
This change is confidential. Please confirm once payment is sent.

This example is illustrative only. The message has several BEC indicators: a payment-detail change, urgency, secrecy, and a sender address that must be checked carefully.

The appropriate response is to stop the payment change and use a known phone number or other established contact method to confirm it with the supplier. Do not reply to the message or use a contact detail introduced by that message. IC3 specifically recommends out-of-band communication, such as telephone calls, to verify significant transactions.

The email alone does not prove fraud. A real vendor can legitimately change banking information. The point of the decision rule is to require independent confirmation before money moves.

Practical next steps when you see a BEC red flag

Start with the evidence in front of you:

• If you have a suspicious payment request, verify it through a trusted secondary channel before approving or changing payment details.
• If you can access the mailbox involved, review forwarding settings and mailbox rules for unexpected changes. Preserve relevant evidence according to your incident process.
• If the sender claims to use a company domain, compare the complete email address with a known prior address. Do not rely on the display name.
• If your domain is being impersonated, review SPF, DKIM, and DMARC. The FBI recommends configuring those controls to help prevent spoofing and validate email, but they do not prove that every BEC message will be blocked.
• If you need a broader explanation of attacker methods and business impact, read the Business Email Compromise (BEC) attacks: 2025 guide.

Review the email-security controls around impersonation

A BEC payment request needs an independent transaction check first. After the immediate risk is contained, use Palisade's email security guidance to review the controls that reduce exact-domain impersonation.

Email authentication does not prove whether a particular payment request is legitimate, detect every compromised mailbox, or stop lookalike-domain and display-name fraud.