How to detect and defend against business email compromise

Trust is the foundation of business interactions. Online scammers understand and rely on this when they use social engineering tactics to compromise your company. One of their main methods is business email compromise (BEC).

According to the 2026 AFP Payments Fraud and Control Survey Report, underwritten by Truist, BEC was the number one avenue for attempted and actual payments fraud in 2025, cited by 74% of respondents.^{Disclosure 1} It’s also responsible for $2 billion in losses around the world every year.^{Disclosure 2}

In a business email compromise attack, a fraudster impersonates or takes over the account of a trusted employee, vendor, or federal agency. Its success depends on how convincingly it can imitate the account being impersonated. If it works, your employees might hand over sensitive data (including passwords), transfer funds to criminals, or click malicious links that can compromise your computer network.

• The 2026 AFP Payments Fraud and Control Survey Report shows organizations are implementing various fraud prevention measures to combat BEC—with many reporting improved detection and mitigation outcomes.
• In 2025, 96% of surveyed companies began routinely verifying changes to invoices, bank deposits, and contact details.
• Almost 60% of these businesses perceived this prevention practice as very effective at preventing fraud, with 33% labeling it effective.
• Another 96% of surveyed companies implemented employee trainings to help identify fraudulent emails and spear phishing attempts—with 42% perceiving the prevention method as very effective, and another 42% as effective.^{Disclosure 1}

Case study: Comparing addresses helps a pharmacy stop a BEC attack. When an order for $500,000 in prescription medications came in supposedly from a large medical center, pharmacy staffers carefully checked the details. Even though the paperwork looked valid, one employee noticed the address in the email didn’t match the one on file. When the employee called the medical center, a representative told them the order was a sham.^{Disclosure 3}

Anyone can be the target of business email compromise. Knowing what signs to look for—and what actions to avoid—can help keep your employees from falling victim. Here are some common strategies for preventing BEC attacks.

Train staff to double-check email addresses and message details.

BEC scammers often imitate the email addresses of real employees or business associates. The giveaway may be something as small as one- or two-letter inconsistencies in the username or a misspelled domain after the @. These imposter emails often express urgency, arrive at odd hours, appear to come from an executive or person of authority, and may request secrecy or reference an unfamiliar project.

Educate staff on the most likely BEC targets.

Knowing where a BEC attack has the highest probability of occurring helps your staff spot and prevent attacks. The 2026 AFP Payments Fraud and Control Survey Report found that the most common payment methods targeted in BEC scams during 2025 were wire transfers (49%), ACH debits (34%), Checks (33%), ACH credits (31%), and corporate/commercial credit cards (10%).^{Disclosure 1}

Limit what you publicize about employees, roles, and email addresses.

Every BEC attack relies on access to employee details such as names, titles, and email addresses. Only share that information with trusted partners—and encourage them to report any suspected attacks, whether attempted or successful.

Require strong passwords and multifactor authentication.

Sometimes, hackers will take over the actual email account of someone you trust and send emails directly from it. When used properly, passwords and multifactor authentication (MFA) can go a long way toward preventing this. Educate employees to create and protect strong passwords, change them regularly, and use MFA to provide an extra layer of security against password theft.

Make dual control a number one priority.

Implement dual control policies to help identify spoofs, inconsistencies, and other red flags that indicate BEC attacks. With dual control, two eagle-eyed experts in your company must approve any requests for sensitive information like banking details or credential sharing.

When in doubt, talk to Truist.
There are certain requests we will never make of our customers. If you’ve received an email, text, or voice message asking for private banking details like your account number, routing number, or PIN, reach out and alert your relationship manager. Our fraud prevention experts can help identify, report, and neutralize any phishing attacks.