Business Email Compromise: How It Happens and What to Do in the First 48 Hours

Business email compromise (BEC) is a fraud in which criminals use a hijacked or impersonated email account to persuade staff to pay money into an account they control, most often by faking a supplier's change of bank details or an urgent instruction from a senior executive. In the first 48 hours after discovery, the priorities are to call your bank to try to stop or hold the payment, report on the 1930 helpline or cybercrime.gov.in, assess whether the incident must be reported to CERT-In within six hours, and preserve the email and system logs before anything is cleaned up. Speed decides how much can be held; evidence decides how much can be proved.

How big is the BEC problem?

The FBI's Internet Crime Complaint Center (IC3) received 24,768 BEC complaints in 2025, with reported losses of USD 3,046,598,558, making BEC the second most costly category after investment fraud. IC3 also noted that businesses reported more than USD 30 million in BEC losses involving artificial intelligence.

In India, a Ministry of Home Affairs reply to the Rajya Sabha in July 2026 stated that between FY2023-24 and FY2025-26 more than INR 56,087 crore was reported lost in cyber-fraud complaints, and more than INR 9,079 crore was marked as lien. A lien is a hold on funds, not a recovery, but the gap between the two figures shows why early reporting matters.

How does business email compromise happen?

BEC attacks usually follow one of a few patterns:

The most damaging cases involve a genuine mailbox, because the fraudulent email sits inside a real conversation thread. That is effectively an account takeover of email. Our business email compromise entry explains the scheme types in more detail, and our post on account takeover and SIM-swap fraud covers related attacks.

What should you do in the first 48 hours?

Hours 0–2: try to stop the money

1. Call your bank's fraud or payment operations desk immediately and ask it to recall or hold the transfer and alert the beneficiary bank. Follow up in writing.
2. Report on 1930 or cybercrime.gov.in. The Citizen Financial Cyber Fraud Reporting and Management System, launched in 2021 and run by the Indian Cyber Crime Coordination Centre, links complaints to banks so that funds can be flagged and placed on lien.
3. Stop further payments to the affected supplier or beneficiary until bank details are verified through a known, independent channel.

Have the transaction reference, amount, date, time and beneficiary account details ready before the call.

Hours 0–6: assess CERT-In reporting

The CERT-In Directions issued on 28 April 2022 under s. 70B(6) of the IT Act 2000 apply to service providers, intermediaries, data centres, body corporates and government organisations. They require the incident types listed in Annexure I to be reported to CERT-In within six hours of noticing them. The list includes identity theft, spoofing and phishing attacks, unauthorised access to IT systems or data, and data breaches.

"Compromise of email" is not a separate category, so whether a particular BEC incident is reportable depends on its facts. Because the clock is short, the decision should be taken early with advice and documented either way.

Hours 2–24: contain and preserve

Containment and preservation must happen together:

• Contain: reset the compromised account's password, revoke active sessions and tokens, enforce multi-factor authentication, and remove malicious inbox rules and forwarding.
• Preserve the message: keep the fraudulent email with its full headers, plus the genuine thread it sits in. Do not delete it.
• Preserve the logs: export mailbox audit logs, sign-in logs and admin activity logs before retention limits apply. Where covered, the CERT-In Directions already require ICT logs to be retained for a rolling 180 days.
• Image affected devices if malware or credential theft on an endpoint is suspected.

Every item collected should be hashed and recorded in a chain-of-custody log. Our guide to preserving digital evidence in internal investigations explains how.

Hours 24–48: scope, notify and investigate

If personal data was exposed, consider data protection obligations. Under the DPDP Rules 2025, which come into force in phases with most obligations applying from around 13 May 2027, a Data Fiduciary will have to inform the Data Protection Board and affected individuals without delay and send the Board a detailed report within 72 hours. Organisations should build that step into their response plans now.

What are the warning signs of a BEC email?

Staff who handle payments should be trained to pause when they see:

• a request to change bank details, especially to an account in a different name, city or country;
• urgency combined with secrecy, such as "do not discuss this with anyone" or "the deal closes today";
• a sender address that differs slightly from the real domain, or a reply-to address that differs from the sender;
• a senior executive asking for gift cards, an unusual transfer or a bypass of normal approvals;
• a change in tone, language or signature within an otherwise genuine thread.

None of these proves fraud on its own, but each is a reason to verify through a separate channel before paying.

What should a BEC response plan contain?

Most organisations discover during their first incident that nobody knows who calls the bank, who decides on CERT-In reporting or who is allowed to touch the mailbox. A short written plan settles this in advance:

1. Named roles for finance, IT, legal and communications, with deputies.
2. Bank contact details for each operating account, including out-of-hours fraud numbers.
3. A reporting decision tree covering 1930 and NCRP, CERT-In, police, insurers and, in time, the Data Protection Board.
4. Preservation steps that IT must complete before remediation removes evidence.
5. Template communications for suppliers, customers and staff.

The plan should be tested at least once a year with a tabletop exercise based on a realistic scenario.

Which laws apply to the fraudsters?

BEC typically involves cheating and cheating by personation under ss. 318 and 319 of the Bharatiya Nyaya Sanhita 2023, together with identity theft and cheating by personation using a computer resource under ss. 66C and 66D of the IT Act 2000. The complaint should set out the facts and attach the preserved evidence. The choice of remedies and forums needs specific legal advice.

How can organisations prevent the next BEC?

Most BEC losses come down to a payment control that relied on email alone. Effective internal controls include:

1. Call-back verification of any change in bank details, using a phone number already on file, never one in the email.
2. Dual authorisation and segregation of duties between changing vendor master data and releasing payments.
3. Multi-factor authentication for all email accounts, with alerts for new inbox rules and unusual sign-ins.
4. Email authentication (SPF, DKIM and DMARC) and external-sender tagging.
5. Training for finance, HR and executive assistants using realistic examples.

Supplier-side impersonation is a form of vendor fraud; our guide to procurement fraud red flags covers the wider controls.

How Spectra Forensics can help

Spectra Forensics has 19+ years of investigation experience across 1,250+ investigations and 10+ countries. Our digital forensics and eDiscovery service covers forensic preservation of mailboxes, logs and devices, and analysis of how an account was compromised. Our fraud and whistleblower investigation service examines whether internal control failures or insiders were involved, and our asset tracing service supports efforts to follow diverted funds.

To discuss an incident, contact us.