Business email compromise (BEC)
Quick answer
A scammer impersonates a senior colleague or supplier to redirect a payment to a fraudulent account.
- Verify any payment change by phone using a known number, not the email's details.
What it is
A scammer impersonates a senior colleague or supplier to redirect a payment to a fraudulent account.
How it works
Using a look-alike or compromised email, the scammer requests an urgent transfer or shares 'updated' bank details for an invoice.
Red flags to watch for
- Urgent payment requests from an executive
- Changed supplier bank details
- Secrecy and pressure
- Slightly altered email domains
Example
An email appearing to be from a supplier asks you to send payment to a new account. This is risky because changed bank details are a hallmark of BEC fraud.
What not to do
- Do not change payment details based on email alone
- Do not skip verification
The safe next step
Verify any payment change by phone using a known number, not the email's details.
Often seen on: Email.
Commonly targets: Finance teams, Businesses.
How to verify safely
- Do not use links, phone numbers, QR codes, or email addresses from the suspicious message.
- Open the official app or website yourself - type the address manually.
- Call a contact you have saved, or the number printed on your bank card.
- If you are threatened or in immediate danger, contact local emergency services or police.
How to report it
Report to your bank and national cybercrime authority immediately.
Find official links for your country in the scam reporting directory.
Got a message like this?
Check it now to see the specific red flags and what to do next.
Check a messageRelated scam types
Frequently asked questions
What is a business email compromise (bec)?
A scammer impersonates a senior colleague or supplier to redirect a payment to a fraudulent account.
How can I avoid a business email compromise (bec)?
Verify any payment change by phone using a known number, not the email's details.
What should I do if I have already been affected?
Contact your bank or the relevant provider through official channels, change any exposed passwords from a trusted device, and save evidence. See our recovery guides, and be wary of recovery scams that promise to get your money back for a fee.