# Business email compromise is financially motivated > Business email compromise attacks are financially motivated scams that seek unauthorized fund transfers, not typically disruption-motivated attacks or. No. Business email compromise attacks are typically financially motivated scams, not disruption-motivated attacks. The FBI's Internet Crime Complaint Center defines BEC as a scam targeting people and organizations involved in fund transfers, where account compromise, social engineering, or intrusion leads to an unauthorized transfer of funds. An attack can disrupt operations, but disruption is not the defining objective of BEC. ## Quick takeaways - BEC commonly seeks an unauthorized payment, payroll diversion, gift cards, or changed bank details. - A compromised mailbox can let an attacker observe real invoices, contacts, and payment routines before sending a request. - An urgent request to change payment details or keep a transaction secret is a strong red flag. - Verify significant payment changes through a separate trusted channel before moving money. - DMARC can help stop exact-domain spoofing, but it does not stop every BEC tactic. - The FBI's published BEC scenarios contain five categories, not four. ## How business email compromise works [The FBI IC3 definition of BEC](https://www.ic3.gov/CrimeInfo/BEC) focuses on unauthorized fund transfers. The attacker may compromise a legitimate business email account through social engineering or computer intrusion, then use that access to make a payment request look credible. The fraud often depends on context. In its [published BEC scenarios](https://www.ic3.gov/PSA/2017/PSA170504), IC3 explains that attackers can study selected victims, identify people involved in wire transfers, and learn the protocols used inside the business. A phishing message may first collect details such as names or travel dates. A compromised mailbox can also conceal the fraud. The FBI warned that attackers may configure mailbox rules to delete key messages or enable forwarding to an outside account. They can then impersonate communication between a business and its vendor or customer to redirect pending or future payments to a fraudulent bank account. [IC3's cloud-email-services alert](https://www.ic3.gov/PSA/2020/PSA200406) describes those account-takeover tactics. The financial objective is visible in current reporting. The [2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) records 24,768 BEC complaints and about $3.05 billion in reported losses for 2025. These are self-reported complaints to a US federal reporting channel, not measured total losses, and IC3 says its statistics are an assessment at a point in time that may change. Fortra, reported in the [APWG Q1 2026 phishing report](https://docs.apwg.org/reports/apwg_trends_report_q1_2026.pdf), found that observed BEC attempts most often requested gift cards, wire transfers, or payroll diversion. Those figures describe attempted attacks seen in one vendor's telemetry, not confirmed losses. For broader context on email-borne threats, see Palisade's [email security resources](/learning/email-security) and the [email threats hub](/learning/threats). ## When the answer changes A BEC incident can cause disruption. A diverted supplier payment can delay orders, create accounting work, trigger incident response, and damage a business relationship. Those consequences do not change the core classification of the scam when the attacker is trying to obtain money or payment credentials. Use this decision rule: - If the message seeks a payment, altered bank details, payroll change, gift cards, or access that supports a transfer, treat it as potential BEC. - If the primary objective is to disable systems, destroy data, or interrupt operations without a transfer-fraud request, it may be another type of cyber incident rather than BEC. - If the evidence is incomplete, pause the transaction and verify the request outside the email thread. > A payment request that arrives with urgency, secrecy, or changed account details should not be approved from email evidence alone. The FBI recommends using secondary channels or two-factor authentication to verify requests that change account information. Its BEC guidance also says to inspect the actual sender address, especially on mobile devices where address details may be less visible. [IC3's protection guidance](https://www.ic3.gov/CrimeInfo/BEC) supports both checks. DMARC has a narrow but useful role. CISA, NSA, FBI, and MS-ISAC recommend a DMARC policy of `reject` to protect recipients from emails that impersonate a domain. However, [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989) states that DMARC addresses specific forms of exact-domain spoofing and does not address lookalike domains or display-name abuse. A BEC message sent from a compromised legitimate mailbox or a free webmail account can still pass around that control. For the distinction between BEC and related terminology, see [business email compromise also known as](/learning/business-email-compromise-also-known-as). ## Worked example: invoice redirect decision rule Consider a finance employee who receives a message that appears to continue an existing supplier conversation: ```text From: supplier-contact@lookalike-example.com Subject: Updated remittance details Please use the new account details for the invoice due today. This change is confidential. Please confirm once payment is sent. ``` This example is illustrative only. The message has several BEC indicators: a payment-detail change, urgency, secrecy, and a sender address that must be checked carefully. ![Decision flow for validating a suspected business email compromise payment request](/images/editorial/business-email-compromise-attacks-are-typically-disruption-motivated-attacks/business-email-compromise-attacks-are-typically-disruption-motivated-attacks-bec-decision-flow.webp "1200x738") *Source: Palisade.* The appropriate response is to stop the payment change and use a known phone number or other established contact method to confirm it with the supplier. Do not reply to the message or use a contact detail introduced by that message. IC3 specifically recommends out-of-band communication, such as telephone calls, to verify significant transactions. The email alone does not prove fraud. A real vendor can legitimately change banking information. The point of the decision rule is to require independent confirmation before money moves. ## Practical next steps when you see a BEC red flag Start with the evidence in front of you: - If you have a suspicious payment request, verify it through a trusted secondary channel before approving or changing payment details. - If you can access the mailbox involved, review forwarding settings and mailbox rules for unexpected changes. Preserve relevant evidence according to your incident process. - If the sender claims to use a company domain, compare the complete email address with a known prior address. Do not rely on the display name. - If your domain is being impersonated, review SPF, DKIM, and DMARC. The FBI recommends configuring those controls to help prevent spoofing and validate email, but they do not prove that every BEC message will be blocked. - If you need a broader explanation of attacker methods and business impact, read the [Business Email Compromise (BEC) attacks: 2025 guide](/learning/what-is-the-complete-guide-to-business-email-compromise-bec-attacks-in-2025). ## Review the email-security controls around impersonation A BEC payment request needs an independent transaction check first. After the immediate risk is contained, use Palisade's [email security guidance](/learning/email-security) to review the controls that reduce exact-domain impersonation. Email authentication does not prove whether a particular payment request is legitimate, detect every compromised mailbox, or stop lookalike-domain and display-name fraud. ## Sources and further reading - [FBI IC3: Business Email Compromise](https://www.ic3.gov/CrimeInfo/BEC) - [FBI IC3: The 5 Billion Dollar Scam](https://www.ic3.gov/PSA/2017/PSA170504) - [FBI IC3: Cloud-based email services BEC alert](https://www.ic3.gov/PSA/2020/PSA200406) - [FBI IC3 2025 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) - [RFC 9989: DMARC](https://www.rfc-editor.org/rfc/rfc9989) - [APWG Phishing Activity Trends Report, Q1 2026](https://docs.apwg.org/reports/apwg_trends_report_q1_2026.pdf) ## Frequently asked questions ### What are the 4 types of attacks? No. IC3 does not publish a four-type BEC taxonomy. Its [2017 BEC public service announcement](https://www.ic3.gov/PSA/2017/PSA170504) identifies five main scenarios: business working with a foreign supplier, a business executive receiving or initiating a wire-transfer request, business contacts receiving fraudulent correspondence through compromised email, business executive and attorney impersonation, and data theft. ### What are the common tactics used in business email compromise attacks? Common tactics include compromising a legitimate business email account through social engineering or computer intrusion, studying payment workflows, impersonating vendors or executives, and redirecting payments to fraudulent accounts. Attackers may also use mailbox rules or automatic forwarding to hide messages, according to [IC3's 2020 alert](https://www.ic3.gov/PSA/2020/PSA200406). ### What is a red flag for a business email compromise? An urgent or secret request to change payment details is a major red flag. Verify the sender's full email address and confirm the request through a known phone number or another trusted channel before approving the transaction, as recommended by [FBI IC3](https://www.ic3.gov/CrimeInfo/BEC). ### What is a business email compromise? Business email compromise is a scam in which an attacker uses compromised accounts, impersonation, or social engineering to induce an unauthorized transfer of funds. The [FBI IC3 definition](https://www.ic3.gov/CrimeInfo/BEC) applies to both businesses and individuals who conduct transfers. ### Does DMARC stop business email compromise? No. DMARC can help receiving systems reject unauthenticated messages that spoof your exact domain when the domain publishes an appropriate policy. [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989) states that DMARC does not address lookalike domains, display-name abuse, or every fraudulent email. Payment verification and account-security controls remain necessary.