[{"data":1,"prerenderedAt":143},["ShallowReactive",2],{"publication:en:P143":3},{"meta":4,"copy":16,"relatedArticles":129,"terms":130,"term":131,"resourceParent":137,"glossaryParent":140},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15},"P143","\u002Fglossary\u002Fbec","term","what is business email compromise","What is business email compromise? Payment fraud and trusted requests","What is BEC? Business email compromise explained","Understand business email compromise, invoice diversion and impersonation. Distinguish a fraudulent instruction from proof of a compromised mailbox.",[13,14],"\u002Fservices\u002Fcorporate-email","\u002Fservices\u002Fdmarc-spf-dkim","2026-10-30",{"intro":17,"sections":18,"checklist":87,"faq":93,"links":103,"sources":121,"cta":124},"BEC (business email compromise) is a fraud pattern in which a criminal uses a seemingly trusted business communication to redirect money or obtain sensitive information. The instruction may come from an impersonated sender or an abused genuine account. A fraudulent request does not, by itself, prove that your mailbox was compromised; payment verification and account investigation are separate tasks.",[19,28,60,65,74,82],{"title":20,"paragraphs":21,"sources":24},"Understand the business decision the criminal wants to change",[22,23],"Business email compromise targets trust in ordinary business communications. The FBI describes examples involving familiar invoice relationships and requests that redirect payment. For a small business, the practical weakness can be an unchecked change in the instruction: a new beneficiary, a different approval route or an exception that bypasses the person normally responsible for the transaction.","Write down the decision being requested before investigating the email's appearance. Is finance being asked to replace a supplier account, release an urgent transfer or disclose confidential records? Identify the owner of that decision and keep the original approved information separate. A copied signature or familiar invoice format should not be allowed to update the supplier record on its own.",[25],{"label":26,"url":27},"FBI: business email compromise and independent payment verification","https:\u002F\u002Fwww.fbi.gov\u002Fhow-we-can-help-you\u002Fcommon-frauds-and-scams\u002Fbusiness-email-compromise",{"title":29,"paragraphs":30,"table":33},"Separate a deceptive instruction from a compromised mailbox",[31,32],"Several explanations can produce a credible-looking business message. Someone may impersonate a contact, abuse a genuine mailbox, reuse exposed correspondence or persuade a legitimate person to forward a fraudulent instruction. These are possibilities to investigate, not conclusions established by the request. Keep the financial hold in place while the technical owner checks the relevant accounts and evidence.","Our evidence map separates what the team observed from what remains unknown. It avoids delaying an urgent bank conversation until the company has proved the attack method. At the same time, it prevents a technical report from claiming an account takeover merely because a message mentioned a genuine invoice. Record the limits of the evidence alongside each operational decision.",{"caption":34,"headers":35,"rows":39},"BEC observation and separate investigation question",[36,37,38],"Observation","Immediate business question","Technical question still open",[40,44,48,52,56],[41,42,43],"New payment details","Who independently verified the beneficiary?","Was any mailbox accessed without authorization?",[45,46,47],"Familiar email thread","Does the proposed action match the agreed work?","How was the thread obtained or altered?",[49,50,51],"Message from a known address","Is the requester authorized for this decision?","Do provider records show account abuse?",[53,54,55],"Payment already released","Can the bank stop or recall it?","Which accounts, rules or sessions need review?",[57,58,59],"Confidential records requested","Does the recipient have a legitimate need?","Was information already disclosed?",{"title":61,"paragraphs":62},"Build verification outside the suspicious conversation",[63,64],"The verification route should exist before the sensitive request arrives. Use a contact already established in the supplier or customer relationship, with a documented way to handle an unavailable contact. A replacement phone number or chat address supplied in the questionable message cannot independently confirm that same message. Returning to the familiar thread also keeps the conversation within the disputed channel.","Verification needs to cover the intended beneficiary and the actual change, not simply whether a person sent an email. Separate identity, authority and approval to release funds. A known supplier employee may still lack authority to change the bank account. Record who verified the change, where the trusted contact came from and which authorized person approved the update under the business's own process.",{"title":66,"paragraphs":67,"sources":70},"Know what the technical review can establish",[68,69],"When a mailbox may be involved, ask its administrator to review account activity and relevant configuration using current provider guidance. Microsoft's Microsoft 365 response documentation includes session revocation, authentication-method review, application consent and forwarding checks. Those steps belong to a controlled account response. They are not a substitute for a finance owner checking whether a particular payment was authorized.","Preserve useful records before making changes that would obscure the sequence, while allowing urgent containment when required. Document the owner, time and reason for each action. A working mailbox after a password change is not sufficient evidence that every unauthorized access path was addressed. Keep unknowns visible and involve the provider or an appropriate specialist when the needed evidence is unavailable.",[71],{"label":72,"url":73},"Microsoft: responding to a compromised Microsoft 365 email account","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-office-365\u002Fresponding-to-a-compromised-email-account",{"title":75,"paragraphs":76,"example":79},"Act on money movement without promising recovery",[77,78],"If a transfer was made or payment details were submitted, use a genuine bank or payment-provider contact promptly and explain the suspected fraud. Preserve the transaction reference and payment status. A pending instruction, completed transfer and attempted beneficiary change may require different handling. Do not wait for routine technical support to determine the attacker's identity before contacting the financial provider.","Financial recovery cannot be guaranteed. The business should also check its incident, insurer and reporting responsibilities for the affected countries. A public FBI source describes US reporting options; it is not a universal instruction for every worldwide company. Keep any technical enquiry separate from sensitive bank records until an appropriate secure exchange and a clear scope have been agreed.",{"title":80,"text":81},"Illustrative example: the invoice remains genuine","A fictional buyer expects an invoice from a regular supplier. The amount and invoice number are correct, but the bank account has changed. Finance holds the update and verifies the change through its stored supplier contact and approval process. The correct invoice details help describe the request; they do not authorize the replacement beneficiary. No actual fraud case or recovered payment is claimed.",{"title":83,"paragraphs":84},"Reduce the dependence on a single employee spotting a scam",[85,86],"Keep supplier changes, payment release and technical account ownership understandable to the people who actually handle them. Provide an alternate approver and a route to report uncertainty without penalty. Review whether a shared mailbox or a departing employee's access can silently change sensitive instructions. A rehearsal can test the handoff between finance and the administrator without sending a deceptive message to real staff.","CyberFixCrew is an Israeli cybersecurity company working with businesses worldwide. Our practical Israeli technical knowledge supports scoped business-email, account-access and digital-infrastructure work. We can discuss the technical part of a business concern within the services described here. We do not claim to provide bank recalls, guaranteed fraud recovery, legal determinations or a continuously staffed incident-response service.",[88,89,90,91,92],"Identify the transaction or disclosure being requested.","Hold an unverified beneficiary or approval-route change.","Use a previously trusted contact and a separate authorized approver.","If funds moved, contact the genuine financial provider promptly.","Investigate account evidence separately and record unresolved questions.",[94,97,100],{"question":95,"answer":96},"Can BEC happen without my own email account being hacked?","Yes, impersonation or abuse elsewhere in the conversation can produce a deceptive instruction. Establish account compromise through relevant evidence rather than the request alone.",{"question":98,"answer":99},"Does email authentication authorize a bank-account change?","No, technical sending checks and business approval address different questions. Verify the beneficiary and the requester’s authority through the established change process.",{"question":101,"answer":102},"Can CyberFixCrew recover a fraudulent transfer?","No recovery service or outcome is promised here. Contact the genuine bank or payment provider promptly; technical account work is a separate scope.",[104,107,110,113,116,118],{"path":105,"label":106},"\u002Fblog\u002Finvoice-bank-change-scam","Verify supplier bank-detail changes",{"path":108,"label":109},"\u002Fblog\u002Fdeepfake-payment-call","Apply verification to voice and video requests",{"path":111,"label":112},"\u002Fblog\u002Fmicrosoft-365-account-compromise","Respond to suspected Microsoft 365 account compromise",{"path":114,"label":115},"\u002Fblog\u002Femail-spoofing-domain","Separate spoofing from account access",{"path":13,"label":117},"Discuss corporate-email technical work",{"path":119,"label":120},"\u002Fservices\u002Faccess-2fa-audit","Review account access and authentication",[122,123],{"label":26,"url":27},{"label":72,"url":73},{"title":125,"description":126,"button":127,"type":128},"Clarify the technical part of a suspicious business request","Tell us which email or account-control issue needs review. If money has moved, contact your bank first through a verified channel.","Discuss the email-control scope","check",[],[],{"name":132,"aliases":133},"BEC (business email compromise)",[134,135,136],"BEC","business email compromise","business email fraud",{"path":138,"label":139},"\u002Fresources","Website security resources and templates",{"path":141,"label":142},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134057891]