Business Email Compromise (BEC)

Business Email Compromise (BEC) is a targeted social‑engineering cybercrime in which attackers impersonate executives, vendors, or legal representatives—or compromise real email accounts—to trick organizations into transferring funds or disclosing sensitive data. The report summarizes BEC attack types (CEO fraud, account compromise/EAC, attorney impersonation, false invoices, data theft), the typical lifecycle (reconnaissance, compromise/impersonation, social engineering, execution/exfiltration), business impacts (direct financial loss, operational disruption, reputational and regulatory consequences), and layered defenses (MFA, DMARC/SPF/DKIM, transaction verification processes, security awareness training, and incident response planning).