Business email compromise is a growing online scam in which criminals impersonate executives, suppliers, or trusted contacts to manipulate employees into transferring money or revealing sensitive information.
These attacks often rely on convincing emails, compromised accounts, and carefully researched details rather than obvious technical flaws. Understanding how business email compromise works can help consumers and organizations recognize warning signs before financial or personal data is lost.
Business email compromise is an online scam in which criminals impersonate a trusted person or compromise a legitimate email account to manipulate an individual or organization. Their objective is often to obtain money, sensitive information, or access to digital systems.
Attackers may monitor email conversations, copy writing styles, and use familiar logos or signatures to appear credible. Common scenarios include requests to change payment details, approve an urgent transfer, share login credentials, or purchase gift cards.
These messages can be difficult to identify because they may come from genuine accounts rather than newly created addresses. However, unusual urgency, unexpected payment instructions, spelling inconsistencies, or requests that bypass normal procedures should raise suspicion.
Protective measures include enabling multifactor authentication, verifying financial requests through a separate communication channel, examining the complete sender address, and limiting account access. Businesses should also train employees to report suspicious messages promptly, since rapid reporting can help prevent or recover fraudulent transactions.