What is business email compromise?

Business email compromise (BEC) is one of the most financially damaging forms of cyber fraud because it targets the payment process itself rather than an individual's bank account. The fraudster does not need to break into the bank. They only need to persuade someone with authority to send money to the wrong place.

The FBI's Internet Crime Complaint Center recorded 24,768 BEC complaints with reported losses of about USD 3.05 billion in its Internet Crime Report 2025, second only to investment fraud. The same techniques are used against Indian organisations, and any business that pays suppliers on the strength of emailed instructions is exposed.

How does business email compromise work?

Common variants include:

• Invoice or payment redirection: a "supplier" writes to say its bank account has changed, attaching a convincing letter. The next payment goes to a mule account.
• CEO or executive fraud: an urgent, confidential request from the "managing director" to transfer funds for an acquisition or settlement.
• Supplier account compromise: the real supplier's mailbox is hacked, so the fraudulent request arrives in the genuine email thread.
• Data theft: requests to HR or finance for employee tax or salary data.

Many BEC frauds begin with phishing that harvests mailbox credentials. Attackers then sit quietly in the account, read correspondence, set up hidden forwarding or inbox rules, and strike when a large payment is due. Others rely purely on spoofed or lookalike domains.

What does Indian law say?

• IT Act 2000: s. 66C (identity theft) and s. 66D (cheating by personation using a computer resource), each punishable with up to three years and a fine up to INR 1 lakh; s. 43 and s. 66 for unauthorised access to the mailbox.
• Bharatiya Nyaya Sanhita 2023: cheating and dishonestly inducing delivery of property under s. 318(4), cheating by personation under s. 319, and forgery of electronic records under s. 336.
• CERT-In Directions (28 April 2022): covered entities must report specified incidents within six hours, including unauthorised access to IT systems or data and identity theft, spoofing and phishing attacks.

Victims should report immediately on the 1930 helpline or cybercrime.gov.in. Government data shows a gap between amounts reported, amounts marked as lien and amounts actually refunded, so speed is critical.

Red flags of BEC

• A change of bank details communicated only by email, especially to an account in a different name or country.
• Slight differences in sender domain, display name or reply-to address.
• Pressure to bypass the usual approval or call-back process.
• Requests timed for when the approver is travelling or unavailable.
• New inbox rules that move or delete messages containing words like "invoice" or "payment".

How is a BEC incident investigated?

A forensic response preserves mailbox data and sign-in logs, identifies when and how the account was accessed, maps forwarding rules and attacker activity, and determines which side of the transaction was compromised. That last point often decides liability between buyer and supplier. In parallel, the money trail is traced through the receiving bank and onward accounts, which is where asset tracing becomes relevant.

How does BEC differ from related frauds?

Phishing is often the entry method. Account takeover is the broader category of hijacked accounts, of which a compromised mailbox is one example. BEC differs from classic vendor fraud, which is usually committed by or with an insider or a dishonest supplier rather than an external impersonator. Strong internal controls, especially independent call-back verification of bank-detail changes, are the most effective defence.

For a practical response plan, read business email compromise: what to do in the first 48 hours. Our digital forensics and eDiscovery service covers mailbox and log analysis, and our asset tracing and recovery covers following diverted funds.