← All Blogs

Business email compromise is not phishing, and it targets your finance team

By Best IT MSP Editorial Team - Updated October 20, 2026 - 11 min read

The Best IT MSP editorial team maintains this directory's provider data across the US and Canada. We rank providers on verified rating and firmographic data, label paid placement, and do not sell IT services.

Is business email compromise the same thing as phishing?

No. Business email compromise is payment fraud that travels by email. Phishing is credential theft that travels by email. The FBI counts them as separate crime types, and the distance between those two counts is the most useful number an owner can hold in their head.

In 2025 the FBI's Internet Crime Complaint Center logged 191,561 phishing and spoofing complaints against 24,768 for business email compromise. BEC produced roughly an eighth as many incidents. It also produced $3,046,598,558 in reported losses. Same report, same table, two completely different classes of problem.

That mislabelling is why BEC keeps working. Filed under phishing, it gets defended with phishing controls. Those controls watch the mailbox. BEC lives in your payment process. So the money leaves through a door nobody was asked to guard.

Your finance team is the target, not your mailbox. The Association for Financial Professionals surveyed 465 treasury practitioners in January 2026 and found 76 percent of US organizations experienced attempted or actual payments fraud in 2025, with 74 percent affected by business email compromise, up from 63 percent the year before. Three in four. This is a routine operating risk for anyone who pays an invoice.

This article does three things. It separates BEC from phishing using the FBI's own arithmetic, explains why an email filter has nothing to catch, and gives you four written payment rules you can put in place this week without buying anything. Read it beside Report rate, not click rate and Your DMARC record says p=none, which cover the two controls most often mistaken for a defence against this.

What do the FBI's numbers show about BEC versus phishing?

The FBI's 2025 numbers show business email compromise at about 2.5 percent of reported cybercrime complaints and 14.6 percent of reported losses. One sentence, two percentages, and the whole case for treating BEC as a finance problem rather than an email problem.

Here is the working. IC3 received 1,008,597 complaints and $20.877 billion in reported losses in 2025, the first year it passed a million complaints. BEC accounted for 24,768 of those complaints and $3,046,598,558 of those losses. Divide the second pair and you get about $123,005 per complaint. The report's own average loss across all complaints was $20,699. BEC runs at nearly six times the average. That is arithmetic on two numbers printed in the same table, not a separate estimate from somewhere else.

Three comparisons follow from those four figures.

• Volume. Phishing and spoofing filed 191,561 complaints. BEC filed 24,768. Phishing is about 7.7 times more common.
• Loss per incident. Each BEC complaint averages roughly $123,005. The all-crime average loss is $20,699.
• Loss against phishing itself. Phishing and spoofing lost $215,843,126 across those 191,561 complaints, about $1,127 each. BEC averages roughly $123,005, about 109 times more per incident.
• Share. BEC is about 2.5 percent of the complaints and about 14.6 percent of the money.

A control tuned to volume optimizes for the 191,561 and misses the 24,768. Every metric your provider reports monthly rewards catching the common thing. Messages quarantined, links rewritten, attachments stripped, click rate down this quarter. All of those numbers improve while the expensive attack walks past, because the expensive attack is not the common one. Averages hide tails, and BEC is the tail.

The cumulative figures make the scale plain. The FBI's standing public service announcement on BEC records $55,499,915,582 in exposed losses across 305,033 incidents between October 2013 and December 2023, including 158,436 US victims reporting $20,089,561,364. No malware family in that period comes close on reported dollars, and almost none of it needed malware at all.

Why does your email filter have nothing to catch?

Your email filter has nothing to catch because a BEC message usually carries no link and no attachment. It is plain text. One short paragraph asking for a change to bank details, written in a tone your bookkeeper recognizes, often arriving inside a thread that was already running.

Strip out the link and the attachment and you remove almost everything a gateway can judge. There is no URL to reputation-check, no file to sandbox, no macro to detonate. What is left is a sentence in English, and no filter grades grammar for intent. Three mechanics make it worse.

• Display-name impersonation. The attacker types your finance director's name into the display field and spoofs nothing technical at all. RFC 9989, the current DMARC standard, states that such attacks are out of scope for DMARC. We set that out in full in Your DMARC record says p=none and will not re-argue it here.
• A lookalike domain. A domain one character away from yours passes its own authentication perfectly, because the attacker owns it and configured it properly. Authentication confirms who sent a message, not whether the sender is honest.
• A compromised mailbox and a mailbox rule. CISA warns that adversaries who have compromised an account introduce auto-forward rules to collect sensitive information and may hide their rules so they are not visible in Outlook or Exchange Administration tools. Mail sent from inside your tenant authenticates correctly. It is genuine mail carrying a fraudulent instruction.

The survey data points the same way. Spoofed emails topped the list of BEC types, received by 85 percent of organizations in 2025 according to the AFP research. Over half of respondents also reported mail from near-identical domains. These are not exotic techniques. They are the default.

Pretexting is the method that ties it together. The attacker builds a believable story first, often across several polite and entirely unremarkable messages, and only then asks. Nothing in that sequence is urgent until the last message, and nothing in it is clickable. So two of the three numbers your provider reports on human risk describe an attack shape this one does not use. Click rate measures clicks that never happen. Attachment scanning scans attachments that were never sent.

A phishing email needs you to click something. A BEC email needs you to believe something. Only one of those is a filtering problem.

Meanwhile the technical defences keep chasing technical routes. Verizon reports that exploitation of vulnerabilities is now the most common initial access vector for breaches at 31 percent, while credential abuse is down to 13 percent. Patching and endpoint work matter and they are not in dispute. They simply have no bearing on a plain-text email asking your accounts payable clerk to pay a real invoice into a new account.

The five shapes BEC takes when it reaches your finance team

BEC reaches a finance team in five recognizable shapes, and four of them never mention technology at all. Learn the shapes and your staff stop needing to spot a technical tell.

• Vendor impersonation. Someone appears to be a supplier you already pay and tells you the bank has changed. This is the invoice fraud and wire fraud variant, and it carries the largest single losses because it rides on a legitimate invoice for an amount you were expecting.
• CEO fraud. A message appears to come from the owner or the finance director, asks for an urgent transfer, and discourages a callback. The pressure is social, not technical.
• Payroll diversion. An email that looks like it is from an employee asks HR or payroll to change a direct deposit account. The FBI logged 1,053 payroll diversion complaints with $8,323,354 in reported losses between January 2018 and June 2019, an average of $7,904 a complaint, and noted the dollar loss of direct deposit change requests rose more than 815 percent.
• Thread hijack from a compromised mailbox. The attacker is inside a real mailbox, reading a real conversation, and replies in sequence. CISA notes that failing to sever the adversary's access to the account will only temporarily set back the adversary, so a password reset alone does not end it.
• Deepfake voice follow-up. A call arrives to confirm the email. The FBI has warned that malicious actors are more frequently exploiting AI-generated audio to impersonate well-known, public figures, and the same advice applies to your own executives.

Notice the sizes. That payroll sample averaged $7,904 a complaint. The vendor invoice is where the large numbers sit, because the amount is already agreed and nobody questions a figure they were expecting. Payroll diversion is the cheap variant and vendor impersonation is the expensive one, which is exactly backwards from where most training spends its time.

Every one of the five ends in the same request. Change where the money goes. That single sentence is the trigger your process needs to flag, and it is the reason the fix is non-technical.

Illustration, not a real incident. A supplier's mailbox is compromised. Inside an existing thread about an invoice already approved, a reply arrives saying the account has moved to a new bank, with a PDF remittance slip attached for the file. The message authenticates correctly, because it genuinely came from the supplier's mailbox. Your clerk updates the record and pays the invoice on the due date. Nothing in that sequence trips a filter, and nobody did anything a training video told them not to do.

How do you stop invoice fraud without buying a new product?

To stop invoice fraud, move the control out of the mailbox and into the payment process. Four written rules do most of the work, and none of them requires software, a licence, or a technical skill.

• Verify every change to bank details out of band. The FBI's own guidance is to use secondary channels and/or two-factor authentication to verify requests for changes in account information. Call the supplier on a number from your own vendor file.
• Require dual approval above a threshold you set. One person enters the payment, a different person approves it, and the approver checks the bank detail rather than the amount.
• Forbid any payment detail change made from an email thread alone. Write that sentence down, date it, and put it where your bookkeeper can point at it when somebody pushes back.
• Confirm the change in a second channel once it is done. Tell the supplier or the employee by phone as well as by email, so a diverted payment surfaces in days instead of at the next statement.

Out-of-band verification is the rule people get wrong, so define it precisely. Out of band means a channel the attacker does not control. A reply to the email is not out of band. A phone number printed inside the email is not out of band. A number on the new remittance slip is not out of band. The only number that counts is one you already held before the request arrived.

The callback needs one more guard now that voices are cheap to fake. The FBI advises recipients to independently identify a phone number for the person and call to verify their authenticity. Independently is the operative word. You dial out, they do not dial in, and a deepfake voice on an inbound call proves nothing.

Set the dual approval threshold at a figure you could not absorb this month, not at a figure an auditor suggested. A firm billing $2 million a year and a firm billing $200,000 a year need different numbers, and the owner is the only person who can name it honestly. Then write it into the payment controls alongside who holds the approval, and review it once a year.

None of this is a technology project, which is why it rarely gets scheduled. The AFP found that only 17 percent of organizations use AI to combat payments fraud, and that statistic is sometimes read as a gap to close with tooling. Read it the other way. The control that works here is a phone call and a second signature. Nobody sells those, so nobody pitches them.

What to ask your IT provider and your bookkeeper this week

Ask six questions, write the answers down, and date them. Three belong to your IT provider and three belong to whoever pays your invoices. A good answer contains a number or a date. A weak answer names a product.

• Read me our written rule on changing a supplier's bank details, as it stands today.
• Name the dollar threshold above which a second person has to approve a payment.
• Show me the last time somebody called a vendor to verify a change, and where that phone number came from.
• List every mailbox carrying a forwarding rule or an inbox rule right now, including the ones CISA warns adversaries hide so they are not visible in Outlook or Exchange Administration tools.
• State which finance staff have had targeted training on invoice fraud specifically, rather than generic phishing awareness.
• Confirm who you call first, and in what order, if a payment turns out to be fraudulent.

The split in those answers is the point. Questions four and five sit with your provider, because auditing mailbox rules, enforcing authentication and training staff are services you already pay for. Questions one, two, three and six sit with you, because nobody can write your payment approval rules except you. A provider who answers the mailbox questions fluently and shrugs at the payment questions has just shown you where your actual exposure is.

Make the answers measurable. Ask for the date of the last mailbox rule audit and the count of rules found, not an assurance that it is monitored. If your provider holds administrator access to your tenant, read How to audit your MSP's privileged access before that conversation, and check our business email security page for what a filtering and authentication service should cover. Then compare the gaps against Email security best practices.

What to do if a fraudulent payment has already gone out

To recover a fraudulent payment, call your bank within hours rather than days. The FBI states it plainly. If you discover a fraudulent transfer, time is of the essence. Four steps, in this order.

• Call your financial institution and request a recall of the funds, along with any necessary indemnification documents.
• File a complaint at ic3.gov as soon as possible, regardless of the amount lost, because the FBI's recovery process depends on speed.
• Preserve the mailbox and the thread. Delete nothing, and do not clean up before anyone has looked.
• Check for a mailbox rule before and after the password reset, since CISA warns that cutting access incompletely leaves the adversary able to add the rules back.

The timing asymmetry here is brutal, and it is the last argument for preventing rather than detecting. IBM reports that it takes an average of 247 days to identify and contain an active breach across all industries, against a global average breach cost of $4.99 million. A domestic transfer clears the same afternoon. No detection programme, however good, operates on the timescale that would save the money.

So the honest summary is short. Email controls reduce how often a fraudulent request reaches a human. Payment controls decide whether it gets paid. Only the second one is yours, nobody can promise either is complete, and a provider who claims a filter has solved business email compromise has told you they are reading the wrong column of the FBI's table.

We are an independent directory, so we have nothing to sell you here. Take the six questions to three merit-ranked providers in your city, write down who gives you dates and counts, and keep the written payment rules whoever you pick.

FAQ

Is business email compromise a type of phishing?

No. The FBI counts them as separate crime types. Phishing steals credentials, while business email compromise redirects a payment. In 2025 the FBI logged 191,561 phishing and spoofing complaints against 24,768 for BEC, yet BEC caused $3,046,598,558 in losses. Different attack, different defence.

How much does a business email compromise incident cost?

About $123,005 on average, by the FBI's own 2025 figures. Dividing $3,046,598,558 in BEC losses by 24,768 BEC complaints gives that number, against an average loss of $20,699 across all 1,008,597 complaints. Per incident, BEC runs at nearly six times the average cybercrime loss.

Why does email filtering not stop invoice fraud?

Because a BEC message usually contains no link and no attachment, so a filter has nothing to scan. Display-name impersonation needs no technical forgery, and RFC 9989 confirms such attacks are out of scope for DMARC. Mail from a compromised mailbox authenticates correctly because it is genuine mail.

What is out-of-band verification for a bank detail change?

Out-of-band verification means confirming a change through a channel the attacker does not control. The FBI advises businesses to use secondary channels and/or two-factor authentication to verify requests for changes in account information. Call a number from your own vendor file, never a number supplied in the request.

Who in a small business is most likely to be targeted by BEC?

Whoever can change where money goes, which usually means accounts payable, payroll and the bookkeeper. The AFP found 74 percent of US organizations were affected by business email compromise in 2025, up from 63 percent. Train those roles on invoice fraud specifically, not on generic phishing awareness.

← All Blogs