# Business Email Compromise (BEC)

A scam where an attacker impersonates a company executive or partner by email to trick an employee into transferring money or data.

**Business email compromise (BEC)** is a scam in which an attacker impersonates a company executive, vendor, or trusted partner, often by spoofing[↗](/spoofing) or hijacking a real email account, to trick an employee into wiring money, sending sensitive data, or changing payment details. Unlike mass phishing[↗](/phishing), BEC attacks are usually carefully researched and targeted at specific individuals.

Because BEC emails often contain no malware[↗](/malware) or malicious links, just a convincingly worded request, they can slip past traditional email security filters. Verifying unusual financial requests through a separate communication channel, like a phone call, is one of the most effective defenses.