# Business email compromise and CEO fraud, explained for small firms

> How business email compromise and CEO fraud work, what they cost according to the FBI and UK Finance, and the controls a small business can put in place.

**Business email compromise**, or BEC, is a scam in which criminals take over or imitate a business's email to trick staff into sending money or sensitive information. CEO fraud is its best-known form: a message that appears to come from the boss asks for an urgent transfer. Because the email can come from a real account, the defense relies on procedures more than on spotting a fake.

**Key takeaways**

1. The FBI's IC3 recorded 24,768 business email compromise complaints in 2025, with reported losses of $3.05 billion, second only to investment fraud.
2. UK Finance reported £5.6 million lost to CEO fraud in the UK in 2025, the highest average loss per case of the eight scam types it tracks.
3. The UK's NCSC recommends verifying important email requests through a second form of communication, such as a phone call.


## What business email compromise is and how to stop it

Business email compromise is fraud that uses a company's own email, or a convincing copy of it, to divert money. The FBI defines it as a scam targeting businesses and individuals that regularly pay suppliers by transfer, carried out by compromising email, and increasingly phone numbers and video calls too. It differs from ordinary phishing in one way that matters: the message may come from a real mailbox, in a real conversation, so [the usual signs of a fake message](/guides/account-security/phishing-and-scams/) may all be missing. The UK's NCSC calls it [business payment fraud](https://www.ncsc.gov.uk/section/respond-recover/business-payment-fraud) and treats it as an incident to respond to, not just an email to delete.

### How an attack unfolds

1. **Access.** The criminal gets into a mailbox, yours or a supplier's, usually with a phished or reused password, or registers an address one letter away from the real one.
2. **Observation.** They read conversations quietly, sometimes for weeks, to learn who pays whom, when, and in what tone.
3. **Timing.** When a payment is due, they step in: new bank details, a “final” invoice, or an urgent request from the boss.
4. **Pressure.** The request is confidential, urgent, or both, so that nobody checks.

### CEO fraud

In CEO fraud, the message appears to come from a senior person: the owner, a director, or the head office. The Canadian Anti-Fraud Centre [lists the variants it sees](https://antifraudcentre-centreantifraude.ca/scams-fraudes/spear-phishing-harponnage-eng.htm), including an executive asking for gift cards or an urgent transfer abroad, an employee asking to change where their pay is deposited, and a fake head office. In the UK, UK Finance recorded £5.6 million lost to CEO fraud in 2025 across 197 cases. That is a fraction of the total, but it had the highest average loss per case of the eight scam types it tracks, at just over £28,000.

### The scale in the US

The FBI's Internet Crime Complaint Center recorded, in its [2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf), 24,768 business email compromise complaints in 2025, with reported losses of $3.05 billion, up from $2.77 billion in 2024. That makes it the second costliest type of fraud reported to the IC3, after investment fraud. Divided by the number of complaints, that is roughly $123,000 per complaint, our calculation rather than an FBI figure. The FBI also notes that businesses reported over $30 million in losses to BEC scams involving AI in 2025, for example a cloned voice used to confirm a transfer.

### The controls that work

For a small business, a few rules do most of the work:

| Control | Why it helps |
|---|---|
| Verify payment requests and changes of details by phone, on a known number | The NCSC's [guidance on phishing](https://www.ncsc.gov.uk/guidance/phishing) recommends a second form of communication for important email requests |
| Require two people to approve payments above a set amount | A second person is harder to rush |
| Treat any change to payroll or supplier bank details as a separate, verified procedure | It is the moment the scam needs |
| Protect every mailbox with a second factor | Most intrusions start with a stolen or reused password |
| Set up email authentication (SPF, DKIM, DMARC) for your domain | The NCSC recommends it to make spoofing your domain harder |
| Make it safe to say no | Staff must know that refusing an unverified request from “the boss” is the expected behavior |

The last point matters in a small team. Scammers count on hierarchy: a junior employee will hesitate to question a message from the owner. A written rule, agreed by the owner, removes the hesitation.

### If it happens

Call your bank at once and ask it to recall the payment; the FBI stresses that time is of the essence. Tell whoever manages your email and IT, change the passwords of the affected mailboxes, sign out every session, and check for forwarding rules the attacker may have added. Then report it to the national service in your country.

### The most common version

Most BEC losses go through a fake invoice or a change of bank details. See [how payment redirection scams work and the checks that stop them](/guides/account-security/phishing-and-scams/fake-invoices/).

### Before it reaches the inbox

Many BEC attacks start with a phishing email that steals a password. Our guide to [the signs of a phishing email that still work](/guides/account-security/phishing-and-scams/spot-a-phishing-email/) covers that first step.