Business email compromise is not new. But the numbers keep getting worse, and most companies still aren't treating it like the threat it is.
In 2025, the FBI's IC3 received 24,768 BEC complaints with $3.05 billion in reported losses. That's up from 21,442 complaints and $2.77 billion the year before. Since 2013, BEC has accounted for over $55.5 billion in exposed losses globally.
The average loss per incident: roughly $123,000. For a startup, that can be a quarter's runway gone in a single wire transfer.
And BEC attacks are still accelerating. Fortra reported a 22% surge in BEC attacks in mid-2026 alone.
WHY BEC WORKS SO WELL
BEC doesn't rely on malware, zero-days, or sophisticated exploits. It relies on trust.
An attacker compromises or spoofs a legitimate email account and sends a request that looks completely normal: a wire transfer, an invoice payment, a payroll change, updated banking details for a vendor. The email comes from someone the recipient knows and trusts. There's no malicious attachment. No suspicious link. Just a request that looks like business as usual.
That's why BEC accounted for only 2% of observed threats in Microsoft's data but 21% of successful attack outcomes. Compare that to ransomware at 16%. BEC is less common but more effective.
THE MOST COMMON BEC ATTACKS
According to the Association for Financial Professionals' 2024 survey:
- Wire transfer fraud: targeted in 63% of cases
- Executive impersonation: 49% of cases
- Vendor impostor fraud: 45% of cases
- Invoice fraud: 24% of cases
Vendor email compromise alone accounts for roughly 61% of all BEC in federal-sector data. Attackers know that vendor payments are high-volume, routine, and rarely questioned.
WHY STARTUPS ARE ESPECIALLY VULNERABLE
Most startups don't have formal payment verification procedures beyond "the CEO said so." One person often approves and sends wires. Email authentication controls like DMARC, DKIM, and SPF aren't properly enforced. Security awareness training, if it exists at all, doesn't cover BEC specifically. And there's rarely a process for verifying banking changes from vendors or clients.
The typical startup finance workflow: someone gets an email, it looks legitimate, and they act on it. That's exactly the gap BEC exploits.
HOW TO DEFEND AGAINST IT
BEC is a process problem, not a technology problem. The companies that get hit aren't the ones with weak firewalls. They're the ones where a single email can move money without a second check. Here's how to close that gap.
Lock Down Your Email
Start with the basics. Set your DMARC policy to "reject" on all company domains, including domains you don't use for email. Enable DKIM signing on all outbound mail. These controls won't stop every BEC attack, but they make it significantly harder for anyone to send email pretending to be you.
Turn on external sender warnings so your team sees a banner when an email comes from outside the organization. Enable lookalike domain detection in your email security platform. And block auto-forwarding rules to external addresses. Attackers set these up after compromising a mailbox to silently monitor conversations and learn your payment patterns before they strike.
Enforce Strong Authentication
Require MFA on every email account. No exceptions. SMS-based MFA is better than nothing, but authenticator apps or hardware keys are stronger. Disable legacy authentication protocols like POP, IMAP, and SMTP AUTH that bypass MFA entirely. Monitor for impossible travel logins and sign-ins from unfamiliar locations or devices.
A compromised email account is the starting point for most BEC attacks. MFA is the single most effective control to prevent it.
Build Payment Verification Into Your Process
This is where most companies fail. Require dual authorization on any wire transfer, ACH payment, or payment method change. No single person should be able to initiate and approve a payment. Establish a dollar threshold, say $5,000, above which a second approver is mandatory.
Verify all banking changes by calling the requestor at a number you already have on file. Never use contact information from the email requesting the change. That phone number in the email signature could belong to the attacker.
Implement a mandatory waiting period of 24 to 48 hours for new vendor payment setup or changes to existing payment instructions. Speed is the attacker's weapon. Slowing down is your defense.
Treat Vendor Management as a Security Function
Maintain a verified vendor payment registry with confirmed banking details. Any request that deviates from the registered details triggers a verification call before any payment is processed.
Log all payment change requests and approvals. If something goes wrong, you need that paper trail for recovery, insurance claims, and law enforcement. Treat vendor onboarding the same way you treat user onboarding: verify identity, confirm details through a separate channel, and document everything.
Train Your Team on BEC Specifically
Generic phishing training doesn't cut it. Your finance, HR, and executive teams need to know what BEC attacks actually look like. Show them real examples: a spoofed invoice, a compromised vendor email thread, a fake CEO wire request. Run BEC-specific tabletop exercises at least quarterly.
Most importantly, establish a "no pressure" policy. Any request that includes urgency, secrecy, or pressure to skip verification steps gets escalated, not fast-tracked. That urgency is the attack. The person who calls the CEO to verify a wire request should be praised, not treated like they're slowing things down.
Know What to Do When It Happens
If you suspect a BEC payment went through, contact your bank immediately. The FBI's Financial Fraud Kill Chain recovered $679 million in 2025 by freezing fraudulent transfers, but speed matters. You have hours, not days.
File a complaint with IC3 at ic3.gov right away. This is what triggers the kill chain and gives law enforcement a chance to recover your funds. Preserve all email headers, logs, and communications. Don't delete or forward anything from the compromised thread.
The difference between recovering the money and losing it permanently is often how fast you act in the first few hours.
THE BOTTOM LINE
$3 billion in losses last year. $123,000 average per incident. A 22% surge in attacks in 2026. And the attacks are getting better, faster, and harder to spot as attackers adopt AI to generate more convincing impersonation emails.
The fix isn't expensive. It's verification procedures, email authentication, dual authorization, and training your team to question anything that involves money. The cost of not doing it is a wire transfer you can't get back.
Com-Sec helps startups and growth-stage companies build security programs that prevent attacks like BEC before they cost you money. If your payment verification process is "the CEO emailed me," we should talk. Visit com-sec.io.