Business Email Compromise: CEO Fraud & Wire Diversion

What BEC looks like

Business email compromise covers any scheme where email (or a lookalike domain) is used to redirect a business payment. It may be a spoofed “CEO” asking payroll to buy gift cards, a vendor “updating banking details,” or a quiet takeover of your bookkeeper’s real inbox with new forwarding rules.

Common variants

1. CEO / executive fraud

“I’m in a meeting — send a wire today, keep it confidential.” The display name looks right; the address is slightly off, or it is a free webmail account.

2. Vendor bank-change

A long-time supplier emails new ACH instructions attached as a PDF. Without a callback on a known number, AP updates the file and pays the attacker. Deep dive: vendor & invoice fraud.

3. Mailbox takeover

After phishing or password reuse, attackers sit in a real thread, then insert fraudulent payment instructions mid-conversation.

4. Attorney / closing impersonation

Especially around real estate and legal settlements — “updated escrow wiring instructions.”

How a wire gets stolen

1. 1
   Recon. Public org charts, LinkedIn, invoice formats, and who approves payments.
2. 2
   Access or spoof. Phish a mailbox or register a lookalike domain.
3. 3
   Urgency + secrecy. Deadline, audit, acquisition, or “don’t call me.”
4. 4
   Payment diversion. New bank details, crypto, or gift cards.
5. 5
   Rapid cash-out. Funds move through mule accounts within hours.

Red flags

• Last-minute change to bank, routing, or beneficiary name
• Pressure to skip normal approval or keep the request secret
• Slight domain misspellings (company-mail.com vs company.com)
• “Send from my personal Gmail / iCloud — corporate is down”
• Unusual gift-card or crypto payment requests from leadership
• Reply-all threads where only one person suddenly changes payment terms

Controls that work

• MFA on every mailbox — see 2FA / MFA.
• Dual control: two people to release wires/ACH above a threshold.
• Out-of-band verify: known phone callback for any payee change.
• DMARC / SPF / DKIM on your domains to make spoofing harder.
• Disable legacy basic auth; review forwarding rules weekly.
• Train AP and executive assistants with real BEC examples — see employee awareness.
• Paste suspicious payment emails into ScanBeyond before acting.

If you already sent money

1. Call your bank’s fraud / wire recall desk immediately — minutes matter.
2. Preserve the email headers, attachments, and approval trail.
3. File an IC3 report and local police report; notify your cyber insurer.
4. Reset email passwords/MFA; hunt for forwarding rules and mailbox rules.
5. Warn vendors/customers if their threads were used as cover.

FAQ