What this risk is, and why it matters
Business email compromise (BEC) is the highest-frequency, highest-confidence cyber fraud impacting organisations of every size. Vendor-impersonation, executive-impersonation and payroll-redirect schemes routinely produce six- and seven-figure losses through a single misdirected payment. Traditional cyber-defence controls (firewall, antivirus, endpoint protection) do not detect them; verification-of-payment-instruction practice is the dominant control.
Legal and regulatory framework
FBI IC3 reports BEC losses exceeding twenty-six billion dollars over the last decade and growing. Regulator expectations on payment-control quality have hardened; bank carriers increasingly decline cover for losses where the firm failed documented verification standards. Sectoral regulators in financial services treat BEC as a customer-due-diligence and authentication-failure issue. Recent enforcement has pushed personal-liability for finance officers in extreme cases.
Typical scenarios and impact
Documented scenarios include vendor-impersonation schemes where the attacker compromised a supplier's email then issued banking-detail-change instructions; CFO-impersonation schemes where the attacker spoofed senior-officer email to direct urgent transfers; payroll-redirect schemes where individual employees redirected their own salary deposits. Single-incident losses have ranged ten-to-fifty-million in recent reported cases. Insurance recovery has typically run twenty-to-fifty percent of nominal loss.
Mitigation framework and when to engage an expert
Enforce mandatory call-back verification on every banking-detail change using a known-good number. Require dual approval on outbound transfers above a threshold. Train finance, AP and customer-onboarding teams on impersonation indicators with annual refreshers. Maintain phishing-test programmes with documented click-rate tracking. Engage cyber-fraud responders and recovery-counsel within hours of credible BEC suspicion; engage banking-fraud teams for any outbound transfer recovery attempt.