Business Email Compromise (BEC)

BEC is the most expensive scam category in the world — billions per year, per FBI IC3. The attacker impersonates a CEO, CFO, or vendor and asks finance to wire money or change banking details on an invoice.

Unlike volume phishing, BEC often involves no malicious link at all. The whole attack is psychological — a believable-looking email with the right names, the right tone, and a plausible reason for urgency.

Defense: out-of-band verification on any payment-related instruction, mandatory dual-control for new payee setup, and DMARC enforcement on your own domain.