Business email compromise

A scam in which criminals hijack or impersonate a business email account to trick staff, clients or suppliers into sending money or sensitive information.

Business email compromise, often called BEC, usually does not rely on malware. Instead, attackers take over a real mailbox through phishing or stolen passwords, or they register a look-alike domain. They then send convincing messages, such as a supplier asking to update banking details, an executive requesting an urgent wire transfer, or a lawyer changing payment instructions on a real estate deal.

BEC is one of the most financially damaging forms of cybercrime for businesses, and funds sent by electronic transfer can be very difficult to recover. Small and mid-sized organizations are attractive targets because payment approvals often rest with one or two busy people. The Canadian Anti-Fraud Centre regularly warns Canadian businesses about these schemes.

Practical tip: never change payment details based on an email alone. Confirm any new or changed banking information by calling a known phone number you already have on file, not one in the message. Protect mailboxes with multi-factor authentication and set up DMARC to make spoofing your domain harder.