Blog

Business email compromise: the $55 billion scam hiding in ordinary invoices

2 November 2026 · 2 min read

Business email compromise (BEC) is the least dramatic cybercrime and one of the most expensive. No ransomware screen, no stolen database: just an email that looks like it comes from someone you work with, asking for a payment that seems routine.

In September 2024 the FBI published a figure that is hard to forget: $55.5 billion in exposed losses from BEC worldwide between October 2013 and December 2023, across 305,033 incidents. BEC has been reported in all 50 US states and 186 countries.

How it works

The FBI describes BEC as criminals gaining access to, or convincingly imitating, a legitimate business or personal email account, and then using it to get money moved. Common patterns:

• a supplier's account is hijacked, and its next invoice carries new bank details;
• a message "from the boss" asks finance to pay something urgently and quietly;
• a lookalike domain (one letter different) is used to join an existing email thread;
• some versions ask HR for employee personal information to use in later fraud.

The FBI also notes that more stolen money now passes through payment processors and cryptocurrency exchanges, which makes it harder to recover.

The checks that stop it

The FBI's recommendations are simple and work at any size:

1. Verify every change of payment details through a second channel: a phone call to a number you already have, not one in the email.
2. Check the actual sender address, especially on a phone, where only the display name shows.
3. Look closely at links and domains for misspellings.
4. Never send passwords or personal information by email.
5. Use unique passwords and multifactor authentication for every account.
6. Watch accounts for irregularities, such as a customer payment that never arrived.

If it happens

Speed matters. Call your bank immediately and ask for a recall of the transfer, then file a complaint at ic3.gov, whatever the amount. The sooner banks are told, the better the chance of stopping the money.

How KnoxDefender helps

BEC is exactly what KnoxDefender's filtering is tuned for: it flags lookalike domains, display names that match your colleagues but come from outside, reply-to addresses that go elsewhere, and messages that talk about changed bank details or urgent payments, and explains its reasons. The "Invoice and bank-detail changes" and "Supplier and procurement fraud" courses teach the call-back habit. And because KnoxDefender keeps an independent copy of your mail, you can show exactly what was received if a payment ever goes wrong.

Source

• FBI IC3 PSA I-091124-PSA: Business Email Compromise: The $55 Billion Scam (11 September 2024)

Share this story: LinkedIn X Facebook Email

← All stories · Questions? Contact us.