7 BEC Scam Examples (and the Red Flags Your Team Should Catch)

Business email compromise (BEC) scams rarely involve malware. They are polite, well-timed emails that ask someone to do something routine — pay an invoice, update bank details, buy gift cards. That is why they work, and why the FBI consistently ranks BEC among the costliest forms of cybercrime.

Below are the most common BEC scam patterns, what the email typically looks like, and how to stop each one.

1. The fake vendor invoice (vendor email compromise)

How it works: The attacker compromises a vendor’s mailbox — or registers a look-alike domain — and replies inside a real invoice thread: “Please note our bank details have changed. Kindly use the account below for this and future payments.”

Red flags: bank-detail change by email; slight change in the sender domain; urgency near month-end; a PDF invoice that looks right but has different account numbers.

Stop it: never accept bank-detail changes by email alone. Call the vendor on a number you already have — not the one in the email.

2. CEO fraud (executive impersonation)

How it works: An email “from the CEO” to someone in finance: “Are you at your desk? I need you to process a confidential wire today for an acquisition. Don’t discuss it with anyone yet.”

Red flags: secrecy, urgency, the executive being “in a meeting” or “travelling” and unreachable by phone; a display name that matches but an address that does not.

Stop it: dual approval for wires; a culture where questioning an executive’s payment request is expected and praised.

3. Payroll diversion

How it works: HR receives an email from an “employee”: “I’ve changed banks — can you update my direct deposit before the next payroll?” The next salary goes to the attacker.

Red flags: request by email rather than through the HR portal; the employee is suddenly hard to reach; the new account is at an online-only bank.

Stop it: payroll changes only through the HR system with MFA, plus confirmation in person or by phone.

4. Attorney or advisor impersonation

How it works: The attacker poses as the company’s lawyer or an outside advisor handling a “time-sensitive, confidential” matter, often late on a Friday.

Red flags: pressure to bypass normal process; confidentiality requests; a new contact you have never dealt with.

Stop it: verify through a known contact at the firm; any new payee goes through standard approval, no exceptions.

5. Real-estate and closing wire fraud

How it works: Attackers monitor a title company’s, agent’s or buyer’s mailbox and, just before closing, send “updated wiring instructions”.

Red flags: last-minute changes to wiring instructions; emails that arrive just after a legitimate message in the same thread.

Stop it: wiring instructions confirmed by phone with a known contact; clients told in advance that instructions will never change by email.

6. Data theft (W-2 and customer data)

How it works: Not every BEC is about money. An email “from the CFO” asks HR for all employee W-2 forms, or asks sales for a customer export — later used for tax fraud or more targeted attacks.

Red flags: bulk data requested by email; unusual timing; request to send to a personal address.

Stop it: sensitive data requests verified out of band; DLP policies that flag bulk personal data leaving by email.

7. Gift card scams

How it works: A manager “needs” gift cards for a client or staff reward and asks an employee to buy them and send the codes.

Red flags: gift cards as payment; request to scratch and photograph codes; “I’ll reimburse you later”.

Stop it: a simple rule — the company never pays anything in gift cards.

Why BEC emails get through filters

• They come from real, compromised accounts, so they pass SPF, DKIM and DMARC. See what to do if your business email is hacked.
• They contain no links or attachments, just text — nothing for a filter to detonate.
• They reuse real email threads, so they look like normal business.

Controls that stop most BEC scams

Process

• Out-of-band verification for every bank-detail change and new payee
• Dual approval on wires above a set threshold
• A clear “no gift cards, no secrecy” policy

Technology (Microsoft 365)

• Phishing-resistant MFA and Conditional Access to stop account takeover
• DMARC at enforcement to stop exact-domain spoofing
• Defender for Office 365 impersonation protection for executives and key vendors
• External-sender tagging and look-alike domain alerts
• Block automatic external forwarding

People

• Short, scenario-based training for finance, HR and executive assistants — see security awareness training

Not sure your tenant has these in place? A Microsoft 365 security assessment will tell you.

FAQ

What is a BEC scam? A business email compromise scam uses a compromised or impersonated business email account to trick someone into sending money, changing payment details or sharing sensitive data.

What is the most common BEC scam? Fake invoices and bank-detail change requests from compromised or impersonated vendors are among the most common, along with CEO fraud.

Who is targeted by BEC attacks? Anyone who can move money or data: accounts payable, finance managers, HR, executive assistants, and anyone in real estate or legal transactions.

What should we do if we fell for a BEC scam? Call your bank immediately to request a recall, report it to the FBI’s IC3, and secure the affected mailbox. Our BEC response team can help.

Think you’ve been targeted by a BEC scam? Talk to HIFENCE. Contact us.