Fraud How to detect and defend against business email compromise

Trust is the foundation of business interactions. Online scammers understand and rely on this when they use social engineering tactics to compromise your company. One of their main methods is business email compromise (BEC).

According to the 2025 AFP Payments Fraud and Control Survey Report, underwritten by Truist, BEC was the number one avenue for attempted and actual payments fraud in 2024, cited by 63% of respondents. It’s also responsible for $2 billion in losses around the world every year.^{Disclosure 1}

Case study: Comparing addresses helps a pharmacy stop a BEC attack. When an order for $500,000 in prescription medications came in supposedly from a large medical center, pharmacy staffers carefully checked the details. Even though the paperwork looked valid, one employee noticed the address in the email didn’t match the one on file. When the employee called the medical center, a representative told them the order was a sham.^{Disclosure 3}

Anyone can be the target of business email compromise. Knowing what signs to look for—and what actions to avoid—can help keep your employees from falling victim. Here are some common strategies for preventing BEC attacks.

Train staff to double-check email addresses and message details.

BEC scammers often imitate the email addresses of real employees or business associates. The giveaway may be something as small as one- or two-letter inconsistencies in the username or a misspelled domain after the @. These imposter emails often express urgency, arrive at odd hours, appear to come from an executive or person of authority, and may request secrecy or reference an unfamiliar project.

Educate staff on the latest BEC scam tactics.

The 2025 AFP Payments Fraud and Control Survey Report found that classic BEC scams—in which a fraudster impersonates a senior executive and requests a transfer of funds—declined from 57% to 49% in 2024. But scams like vendor and third-party impersonation are on the rise.

Limit what you publicize about employees, roles, and email addresses.

Every BEC attack relies on access to employee details such as names, titles, and email addresses. Only share that information with trusted partners—and encourage them to report any suspected attacks, whether attempted or successful.

Require strong passwords and multifactor authentication.

Sometimes, hackers will take over the actual email account of someone you trust and send emails directly from it. When used properly, passwords and multifactor authentication (MFA) can go a long way toward preventing this. Educate employees to create and protect strong passwords, change them regularly, and use MFA to provide an extra layer of security against password theft.

Make dual control a number one priority.

Implement dual control policies to help identify spoofs, inconsistencies, and other red flags that indicate BEC attacks. With dual control, two eagle-eyed experts in your company must approve any requests for sensitive information like banking details or credential sharing.

When in doubt, talk to Truist.
There are certain requests we will never make of our customers. If you’ve received an email, text, or voice message asking for private banking details like your account number, routing number, or PIN, reach out and alert your relationship manager. Our fraud prevention experts can help identify, report, and neutralize any phishing attacks.

Good news: Increased vigilance is mitigating the impact of BEC.