What a Business Email Compromise Actually Costs a Small Business
No malware, no break-in, just a convincing email at exactly the right moment
This post walks through how business email compromise (BEC) works, what the numbers look like, the costs that never show up in the headline figure, and the specific habits that stop it. It is written for owners and office managers, not security specialists.
What Is Business Email Compromise?
Business email compromise is fraud carried out through email. The attacker either takes over a real email account, or convincingly impersonates one, and uses it to trick someone into sending money or sensitive information. There is usually no virus involved. The attack works because the request looks like part of normal business.
It comes in a few common forms:
Vendor invoice redirection. A message that appears to come from a supplier you pay regularly says their banking details have changed. The invoice and the amount are real. The account number is not.
Payroll diversion. An email that appears to come from an employee asks HR or the office manager to update their direct deposit. The next paycheck goes to the attacker.
Executive impersonation. A message that looks like it came from the owner asks an employee to make an urgent payment, buy gift cards, or send a file, and to keep it quiet.
Closing and wire fraud. Common in real estate and other transaction-driven businesses, where a spoofed message supplies new wiring instructions right before funds move.
How Big Is the Problem?
The FBI’s Internet Crime Complaint Center tracks reported losses each year, and business email compromise has ranked among the costliest categories for several years running. The 2025 figures were the highest yet.
Two things are worth keeping in mind about those numbers. First, they only include incidents that were reported to the FBI. Many small businesses never report, either because the loss was quietly absorbed or because they were embarrassed, so the real total is higher. Second, an average that large means a single successful attack can be a business-ending event for a company with thin margins. For comparison, reported ransomware losses in the same data were a small fraction of the BEC total, even though ransomware gets far more attention.
How Does an Attack Actually Unfold?
Most BEC attacks follow a similar pattern. Understanding it helps explain why the defenses we recommend later are the ones that matter.
It usually begins with a stolen password. An employee clicks a fake Microsoft 365 sign-in page, or reuses a password that was exposed in an unrelated breach. With no multi-factor authentication on the account, the password alone is enough.
The attacker reads the mailbox for days or weeks. They learn who the vendors are, how invoices look, who approves payments, and how people write to each other. They often create hidden inbox rules that route certain messages to a folder you never open, so replies from the real vendor never reach you.
At a moment when a real payment is due, the attacker sends the message: new bank details, an urgent request, a revised invoice. It arrives inside an existing email thread, from the right name, with the right context. Nothing about it looks off.
It is usually found when the real vendor calls asking about an unpaid invoice, or when an employee notices their paycheck never arrived. By then the funds have often been moved through several accounts.
In many cases the fraudulent email comes from a genuinely compromised account, not a fake lookalike address. Checking the sender name does not help. What helps is a process that does not depend on trusting the email at all.
What Does It Cost Beyond the Stolen Money?
The transfer itself is the number that gets reported. For a small business, it is rarely the only cost.
Recovery is slow and uncertain
Banks can sometimes recall a wire if they are contacted quickly, and law enforcement has had some success freezing funds when a report is filed fast. After that window closes, recovery drops sharply. Many businesses recover little or none of the money.
The cleanup takes real time
Once an account has been compromised, someone has to work out how far the attacker got. That means resetting credentials, removing hidden inbox rules, checking which other accounts and files were exposed, and reviewing everything the attacker saw. That is hours of skilled work, and the business is distracted for days.
Client and vendor trust takes a hit
If the attacker used your mailbox to send fraudulent requests to your customers or partners, those people now have a reason to question your security. Even when the cause was not negligence, the conversation is uncomfortable, and some relationships do not fully recover.
There can be legal and contractual exposure
If client data, financial details, or payment information was in the compromised mailbox, the business may have notification obligations. Some contracts also carry security requirements that an incident can put in question. Getting this wrong adds cost, and it is a good reason to bring in the right advisors early.
Insurance may not respond the way you expect
Cyber and crime policies treat funds-transfer and social engineering fraud differently, and coverage often comes with sublimits or conditions, such as requiring that payment changes were verified by a callback. It is worth reading your policy before you need it and asking your agent specifically about fraudulent payment instructions.
The people involved carry it too
The employee who processed the payment often blames themselves, even though the attack was designed to be convincing. That is a real cost to morale and retention, and a reason to treat these incidents as process failures rather than personal ones.
What Actually Stops Business Email Compromise?
No single tool solves this, because the attack targets people and process as much as technology. The defenses that work are layered, and none of them is exotic.
Multi-factor authentication on every mailbox
Since most attacks begin with a stolen password, requiring a second verification step shuts down the most common way in. It should apply to every account, including executives, shared mailboxes where possible, and anything used for finance. Where available, use stronger methods such as authenticator app prompts or security keys rather than text messages.
Email security that checks the sender, not just the content
Modern email filtering can flag messages from lookalike domains, newly registered domains, and impersonation of known contacts. Properly configured domain authentication (SPF, DKIM, and DMARC) also makes it harder for attackers to spoof your own domain to your customers.
Monitoring for the warning signs inside the mailbox
Hidden inbox rules, unexpected forwarding to outside addresses, and sign-ins from unfamiliar locations are all detectable. A managed provider should be alerting on those, so a compromised account is caught in hours instead of weeks.
A payment verification rule that never bends
This is the single most effective habit, and it costs nothing. Any request to change bank details, any new vendor, and any unusual payment gets verified by phone, using a number already on file, never one from the email itself. For larger amounts, require a second person to approve. The rule has to apply even when the request appears to come from the owner and is marked urgent, because urgency is the attacker’s main tool.
Training that is short and specific
Employees do not need a lecture on cybersecurity. They need to know the four or five versions of this scam, that a request to keep something quiet is a red flag, and that pausing to verify is always acceptable and never an insult.
What Should You Do If You Think It Has Happened?
Speed matters more than anything else, particularly for the money.
- Call your bank immediately and ask them to attempt a recall of the transfer. Do this before anything else.
- File a report with the FBI’s Internet Crime Complaint Center at ic3.gov, and keep a record of the transaction details.
- Contact your IT provider so the affected mailbox can be secured and examined. Do not delete anything, since the messages are evidence.
- Reset the passwords and sign-in sessions for the affected account, and check for hidden inbox rules and forwarding.
- Notify your insurance carrier early, since many policies require prompt notice.
- Tell the employees involved what is happening, and make clear that the goal is to fix the process, not to assign blame.
A Quick Self-Check for Your Business
If you can answer yes to all of these, you are in better shape than most small businesses. If not, those are the places to start.
- Is multi-factor authentication turned on for every email account, including the owner’s?
- Does your team have a written rule to verify payment changes by phone using a known number?
- Does a second person approve payments above a set amount?
- Would anyone notice a new inbox rule or an outside forwarding address on a mailbox?
- Does your email security flag lookalike domains and impersonation attempts?
- Do you know what your insurance policy says about fraudulent payment instructions?
The Cheapest Fix Is the One Made Before It Happens
Business email compromise is expensive precisely because it is quiet. There is no warning, and by the time the cost is visible, most of it has already been incurred. The good news is that the defenses are inexpensive and unglamorous: a second verification step, an email filter configured properly, and a phone call before money moves. The businesses that avoid this fraud are rarely the ones with the most sophisticated technology. They are the ones that decided in advance that nobody changes a bank account on the strength of an email.
One Response