Don’t Sleep on Business Email Compromise (BEC) Scams

How BEC scams reel you in

BEC scammers play the long game. They do their homework. They spoof email addresses that are just one character off from the real thing—or hijack a legit one entirely. Then, they go straight for the person who has the authority to move money or access sensitive information.

These messages are sneaky. They seem routine. And that’s the danger—you trust the sender, and you miss the subtle red flags.

It’s not always about money, either. Sometimes it’s employee data. Sometimes it’s tax records. If it’s valuable and they want it, they’ll find a way to get it.

Who are scammers targeting?

If you’re in any of these roles, consider this your official heads-up:

• Executives – You’re high-profile and easy to research.
• Finance teams – You’ve got the keys to the bank accounts.
• HR managers – You handle sensitive employee data.

Scammers love targeting people with access and authority. If that's you, be alert and stay sharp.

Why BEC is a big deal

BEC is booming. It’s one of the biggest cyber threats out there—and it’s only getting smarter. According to the FBI, these scams are becoming more frequent and more sophisticated, often using tactics like gift card fraud to trick even the most vigilant teams. In 2023 alone, the FBI’s Internet Crime Complaint Center (IC3) received over 21,000 BEC reports, adding up to a staggering $2.7 billion in losses.

The threat is real—but so is your ability to stay ahead of it.

How to stay a step ahead of BEC

Employers: Set the tone for security

• Build a culture of double-checking. Make it normal for your team to confirm payment requests directly—no shame in a quick call.
• Set smart standards. Require strong passwords and multifactor authentication (MFA) for access to sensitive systems.
• Train for the real deal. Regularly teach your team how to spot BEC scams and suspicious emails.
• Divide the power. Make sure no one person can both approve and send funds—separation protects everyone.

Employees: Be vigilant, be safe

• Stay skeptical. Just because an email looks official doesn’t mean it is. If something feels off, pick up the phone and confirm using a number you know is legitimate.
• Confirm vendor changes by voice. Don’t rely on email alone for bank or payment updates—verify over the phone.
• Stick to the script. Always follow your company’s process for payments and data sharing. No shortcuts.
• Check the sender’s email—closely. Check for tiny tweaks in email addresses. On mobile, it's especially easy to miss a sketchy domain.
• Keep work details off social. The less scammers know about your role and tools, the harder it is to target you.

If you’ve been targeted, act fast

It’s key that you don’t wait. Speed is everything.

• Monitor financial accounts for missing deposits or odd transactions.
• Contact your bank immediately if something’s wrong—they can freeze your accounts.
• Report it ASAP to the FBI Internet Crime Complaint Center (IC3). The longer you wait, the worse it gets.

Want more peace of mind?

Visit Associated Bank for invaluable tips and tools to help keep you one step ahead of the scammers.