Business email compromise scams

How to protect yourself from becoming a victim

BEC scams rely on urgency and deception. Here’s how you can stay safe:

Slow down
Be suspicious of any request that pressures you to act quickly. Scammers often use urgency to bypass your usual caution.

Verify requests
Always confirm significant transactions or changes to payment details using a trusted method, like a phone call to a known contact.

Don’t just hit “reply”
Instead of replying to business emails, forward the message and manually enter the correct email address to avoid replying to a spoofed account.

Flag suspicious emails
For businesses, create inbox rules that flag emails with extensions that are similar to the company email domain. For example, a detection system for legitimate email of abc-company.com would flag fraudulent email from abc_company.com. 

Secure your domains
For businesses, register all domain names like your own actual company domain. For example, “abc-company.com” would also be registered to the legitimate company “abccompany.com.” 

Watch for unusual activity
Beware of sudden changes in customer activity or authorizations. For example, if a current business contact suddenly asks to be contacted via their personal email address when all previous official correspondence has been via company email, the request could be fraudulent. 

Limit public info
Avoid sharing sensitive business details on social media or your company website that scammers could use to craft convincing messages.