BEC scams: what practitioners need to act on now

TL;DR: Business Email Compromise is now the costliest cybercrime tracked by the FBI, with reported losses exceeding $2.7 billion in 2024 and more than $55 billion globally from 2013 to 2023, according to DNSFilter’s analysis. The control problem is not awareness alone but verification, sender assurance, and transaction discipline when trust is being weaponised at the point of payment.

Editorial analysis by NHI Mgmt Group, based on content published by DNSFilter: “Inside Business Email Compromise Scams: How to Protect Your Business”.

By the numbers:

• Business Email Compromise losses exceeded $2.7 billion in 2024, according to a CertifID summary of the FBI IC3 report cited by DNSFilter.
• Global BEC losses surpassed $55 billion between 2013 and 2023, according to the FBI IC3 public service announcement cited by DNSFilter.
• Overall U.S. cybercrime losses rose 33% year-over-year to $16.6 billion in 2024, according to an FBI El Paso Field Office release cited by DNSFilter.

Key questions

Q: How should organisations reduce business email compromise risk without relying only on awareness training?

A: Use layered controls that verify requests outside the inbox, especially for payments, bank changes, and access-related actions.

Q: Why do phishing and business email compromise continue to succeed even when organisations invest in awareness training?

A: Phishing succeeds because attackers exploit timing, trust, and human judgment, not just technical gaps.

Q: What are the warning signs that a payment request may be a BEC scam?

A: Watch for altered bank details, unusual urgency, secrecy, late-stage changes in an ongoing thread, or requests that bypass normal approval steps.

Practitioner guidance

• Strengthen payment verification workflows Require out-of-band confirmation for any new or changed payment instruction, bank detail, payroll destination, or invoice exception before release.
• Harden email identity controls Enforce SPF, DKIM, and DMARC, and review mailbox permissions that allow external senders or delegated access to imitate trusted communication flows.
• Train against thread hijacking and vendor impersonation Use simulations that include compromised supplier accounts, mid-thread payment changes, and executive urgency rather than generic phishing examples.

Bottom line: BEC is a trust abuse problem that turns legitimate business workflows into payment fraud opportunities.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →