Business email compromise (BEC) is a financially motivated attack where a criminal uses a legitimate or convincingly spoofed email account to deceive someone into transferring funds, changing payment details, or disclosing sensitive information.

It does not require sophisticated malware. It does not need to bypass endpoint protection. It exploits trust, process gaps, and time pressure. A single successful BEC attack against a professional services firm can result in losses of tens to hundreds of thousands of dollars in a single transaction.

The ACCC consistently reports BEC as one of the highest-loss scam categories for Australian businesses. The actual figure is higher than reported, because many losses go unreported due to professional embarrassment.

Train every staff member who handles payments, invoices, or financial data to recognise these:

Implement these with your IT provider:

Implement these in your operations:

Speed is everything. The window for recovering transferred funds closes quickly.

Most BEC losses are not recovered. Fund recovery is possible in some cases if the bank is contacted quickly, but it is not guaranteed and becomes less likely with every hour that passes.

The controls above are not complicated or expensive. The verification process costs a two-minute phone call. The technical controls are configurations, not new platforms. The businesses that suffer significant BEC losses almost always had the information they needed to prevent it.