What is business email compromise, and why does it cost more than ransomware?

Ransomware gets the headlines because it is dramatic. Business email compromise, usually shortened to BEC, quietly takes far more money, and it is the attack most likely to hit a business your size.

In the FBI's most recent Internet Crime Report, reported losses across all internet crime came to roughly 20.8 billion dollars, with business email compromise alone accounting for about 3 billion of it. Reported ransomware losses are a small fraction of that figure. Ransomware is certainly underreported, so treat the gap as indicative rather than exact. The point stands either way: more money leaves businesses through email fraud than through encrypted servers.

How it actually works, in the order it happens:

• Someone gets into a mailbox. Usually a password that was reused and appeared in a breach, or a convincing fake login page. Often not your mailbox at all, but your customer's, your supplier's, or your bookkeeper's.
• They read, and they wait. This is the part people do not expect. They are not in a hurry. They sit in the mailbox for days or weeks, learning who pays whom, how your invoices look, how your people write, and when money typically moves. A forwarding rule often keeps feeding them mail even after the password changes.
• They pick their moment and send one email. New bank details for an invoice you were already expecting. A wire instruction change before a closing. A request from the owner to buy gift cards for a client. Nothing attached, nothing to click, frequently sent from a genuine account they control.
• The money goes, and it moves fast. Funds are typically pulled out and scattered within hours.

Why it works on sensible people. The email is not suspicious. It arrives in a thread you were already part of, about an invoice that is genuinely due, from an address you have corresponded with for years, written in the tone that person actually uses. Nobody falls for this because they were careless. They fall for it because it looked exactly like the thing it was imitating.

There are three defenses and they work together: controls that make it harder to get into a mailbox in the first place, monitoring that spots a mailbox that has been taken over before the money email is sent, and a verification rule that stops payment changes regardless of whether anyone noticed anything. The last one is the only one that works every time, and it is free. The other articles in this topic cover each.