Business email compromise: The billion-dollar scam that refuses to go away

Of all the cybercrime that targets organizations, the most expensive kind has almost nothing to do with sophisticated malware. Business email compromise, or BEC, relies on nothing more than a convincing email and a person willing to act on it. Year after year, the FBI's Internet Crime Complaint Center has reported that BEC accounts for more losses than any other category of cybercrime, and by 2022 the numbers were still climbing. Here is why this low-tech scam refuses to go away and what security awareness training has to do about it.

The most expensive scam in cybercrime

The scale of BEC losses is hard to overstate. Unlike ransomware, which can be loud and disruptive, BEC is quiet. An attacker impersonates a trusted person, usually an executive, a vendor, or a business partner, and requests a payment or a change to payment details. The victim, believing the request is legitimate, complies. By the time anyone realizes the money is gone, it has often been laundered across borders and is unrecoverable. The low visibility and high success rate are exactly why BEC remains the most lucrative form of cybercrime.

Why the low-tech approach keeps working

BEC works because it attacks trust, not technology. There is no malware to detect, no exploit to patch, and no unusual network activity to flag. The email looks right, the request sounds reasonable, and the timing is often carefully chosen to catch the victim at their busiest or most distracted. Attackers invest real time in reconnaissance, learning who can approve payments, how the organization communicates, and what an urgent but plausible request looks like. The sophistication is in the social engineering, not in the code.

The classic BEC playbook

Most BEC attacks follow a recognizable pattern. The attacker either compromises a real account or spoofs a nearly identical address. They send a request that plays on urgency or authority: a rush payment to close a deal, an invoice that must be paid today, or a request to update the banking details for an upcoming transfer. The amounts are chosen to be large enough to be worth the effort but small enough not to trigger extra scrutiny. The goal is a single authorized wire transfer, and it only has to work once to pay off.

Where training breaks the chain

Every BEC attack ultimately depends on a person making a decision to act. Security awareness training is one of the few controls that directly targets that decision, a point the broader research on whether security awareness training reduces incidents reinforces. Employees need to understand that an email from a familiar name is not proof of identity, that urgent payment requests are a red flag, and that any change to payment details must be verified through a separate, pre-agreed channel. Training that ingrains these lessons does more to reduce BEC losses than almost any technical control, because the attack never triggers a technical alert in the first place.

Payment verification as a habit

The single most effective defense against BEC is procedural: never change payment details or approve an unusual transfer based on an email alone. Organizations should require a second, out-of-band confirmation, such as a phone call to a known number or an in-person sign-off, for any payment above a set threshold. This rule has to be non-negotiable and trained until it is automatic. When verification by process, rather than by appearance, is the habit, a single convincing email cannot complete the theft on its own.

The bottom line

Business email compromise is not going away, because it exploits something that will never be patched: human trust. The organizations that suffer the most are those that treat it as an IT problem to be solved with filters and firewalls. The organizations that suffer the least are those that treat it as a people problem, and train their people to verify before they act. That is the durable defense, and it is exactly what security awareness training is for.