Business Email Compromise: The “Fake CEO” Scam That Looks Totally Normal
A short email from “your boss” asks for an urgent transfer. No malware, no weird links—just pressure and perfect timing. Here’s how this scam works and how to spot it.
- BEC scams often contain no links or attachments—just a believable request and urgency
- Attackers rely on look‑alike email addresses, hijacked threads, and social engineering, not technical hacking
- Simple habits (call-back checks, payment rules, and mailbox settings) stop most losses
What “Business Email Compromise” actually looks like (and why it’s so effective)
Imagine it’s a normal workday. You’re in the middle of a dozen tabs, a chat thread is buzzing, and someone is waiting on a document from you. Then an email lands that looks routine:
Subject: “Quick favor”
From: Your CEO (or manager, or a long-time vendor)
Message: “Are you free for a minute? Need an urgent payment handled before lunch. Please keep this confidential.”
No suspicious link. No attachment. No obvious spelling mistakes. It reads like a human wrote it—because often a human did. This is the core of Business Email Compromise (BEC): a scam where criminals use email to trick a person or company into sending money or sensitive information.
BEC is sometimes called the “fake CEO scam,” but it’s bigger than that. The attacker might pretend to be:
- Your boss asking for an urgent transfer
- A supplier claiming their bank details changed
- HR or payroll requesting employee data or a “quick update” to direct deposit
- A lawyer or consultant insisting a deal is confidential and time-sensitive
What makes BEC different from many other scams is how normal it looks. There may be no malware involved at all. Instead, criminals exploit everyday workplace habits: acting quickly, trusting familiar names, and not wanting to “bother” someone by double-checking.
Here’s a realistic mini-scenario:
You work in finance. Your CFO is traveling. You get an email that says, “I’m in meetings—can you wire $18,750 to this account for the deposit? Reply when done.” The tone matches your CFO’s style. You recognize the vendor name mentioned. You’re busy and want to be helpful. You do it.
Later, you learn your CFO never sent that message. The email address was subtly different (or the CFO’s mailbox was compromised). The money is already gone.
This scam is “easy” to fall for because it plays on three things:
- Authority: it appears to come from someone senior or important
- Urgency: it demands speed, not reflection
- Normality: it looks like an everyday email, not a “scam email”
The common tricks: look‑alike domains, hijacked threads, and the “new bank details” message
BEC attackers have a toolbox. They don’t need to be movie-style hackers—they just need to be convincing. Below are the most common techniques, explained in plain language.
1) Look‑alike email addresses (domain impersonation)
This is the digital version of wearing a similar uniform. Attackers register domains that look almost identical to the real thing, such as:
yourcompany.com(real) vsyourcornpany.com(fake; “m” replaced with “rn”)vendor-payments.com(fake) vsvendorpayments.com(real)company.co(fake) vscompany.com(real)
On a phone screen, these differences can be almost invisible—especially in an email app that shows only the display name (“Jane Smith”) and hides the actual address until you tap.
2) Display name spoofing (the name looks right)
Your email client may show: “Alex Chen (CEO)”. But the real sending address could be something unrelated like [email protected] or a look-alike domain. Many people don’t expand the header to verify.
3) Compromised real inboxes (the scariest version)
Sometimes criminals actually get access to a real mailbox—often by stealing a password, tricking someone into logging in on a fake page, or reusing a leaked password from another site. Then they can:
- Read past email threads to match tone and timing
- Reply within an existing conversation (so it looks extra legitimate)
- Set up email forwarding rules to secretly monitor messages
This is how BEC becomes “perfect”: you’re not getting a random email out of nowhere—you’re getting a message inside a real conversation, referencing real invoices, real projects, and real names.
4) The “we changed our bank details” invoice trick
This one hits everyday operations. A message arrives from a supplier (or appears to) saying:
- “We’ve updated our banking information—please use the new account for future payments.”
- “Our bank is migrating systems, so payments must go to this temporary account.”
- “Please see updated remittance details below.”
It’s boring enough to be believable. People assume it’s normal admin work. And if the attacker times it right—right before a scheduled payment—someone may update the bank details and pay the next invoice to the attacker.
5) Gift card or “quick purchase” requests
This version is common in schools, small businesses, and teams with less formal payment processes. The email says:
- “Can you buy 10 gift cards for client appreciation? Send me the codes.”
- “I’m in a meeting—please handle this discreetly.”
Gift cards are attractive to scammers because they’re easy to convert and hard to recover.
| BEC Message Style | What It Asks For | Why It Works | Simple Reality Check |
|---|---|---|---|
| “Quick favor” from a boss | Wire transfer, gift cards, urgent payment | Authority + urgency | Call the boss using a known number (not the email reply) |
| Vendor “bank details changed” | Update beneficiary account | Sounds like routine admin | Verify change via a second channel; require written confirmation process |
| Hijacked email thread | Pay an invoice or share data | It’s inside a real conversation | Check for subtle changes: bank account, tone shift, new urgency |
| HR/payroll “update” | Employee info, W-2s, bank details | Feels internal and trustworthy | Use internal portals/workflows; never send sensitive data by email |
One more detail that matters: BEC emails often keep the request small enough to feel plausible. Not “send $3 million.” More like “$9,840 to secure the shipment.” It’s deliberately sized to slide under your internal “this seems insane” alarm.
How to protect yourself at work (and at home) without becoming paranoid
You don’t need to become a security expert to beat BEC. You need a few habits and team rules that create speed bumps—small frictions that stop a rushed decision.
Start with the simplest mental check: “What would I do if this request came by phone?”
If a boss called and asked for a confidential transfer to a new bank account, you’d probably ask at least one follow-up question. Email can make people skip that. The goal is to bring normal verification back into the process.
- Use a call-back rule for money: If an email requests a payment, bank detail change, or gift cards, verify using a known phone number or a face-to-face check.
- Never verify via “reply”: If the attacker controls the inbox, they control the replies too. Use a separate channel.
- Slow down on “confidential + urgent”: That pairing is a classic manipulation pattern. Treat it as a signal to double-check.
Practical checks you can do in under 30 seconds
- Expand the sender details and look at the real email address, not just the display name.
- Compare with older messages from the same person/vendor. Is the domain identical? Any new spelling changes?
- Look for process changes: “new bank account,” “new payment portal,” “send it as a PDF,” “use this new email.” Process changes are where fraud hides.
Team-level safeguards that actually work
Even if you’re not in charge, it helps to know what good policies look like—because you can suggest them.
- Two-person approval for payments over a set amount (even a low threshold). BEC relies on one person acting alone.
- Vendor change verification: bank detail updates must be confirmed through a second channel and documented.
- Payment templates: store approved vendor bank details in a system; don’t accept new details via email alone.
- Mailbox rule audits: compromised accounts often have sneaky forwarding rules. Periodically check email rules/filters.
What about everyday life? BEC techniques show up outside companies too. Think about:
- Rental scams that ask for a “deposit” to a new account
- Wedding vendor fraud where an attacker changes payment instructions for a venue or photographer
- Family impersonation (“I changed my number—can you send money?”) using email or messaging
The same defenses apply: verify through a known channel, be suspicious of sudden payment-route changes, and don’t let urgency override common sense.
Because the attacker’s product is not a link or a file—it’s a decision. Many BEC messages are short, polite, and plausible on purpose, so they blend into normal work email.
Because the attacker’s product is not a link or a file—it’s a decision. Many BEC messages are short, polite, and plausible on purpose, so they blend into normal work email.
Yes. That’s one of the most damaging versions. If an account is compromised, the attacker can send messages that pass basic “looks legit” checks. That’s why verification must happen outside the inbox.
Yes. That’s one of the most damaging versions. If an account is compromised, the attacker can send messages that pass basic “looks legit” checks. That’s why verification must happen outside the inbox.
Use a call-back (or second-channel) verification for any request involving money, account changes, or sensitive data. It turns a “convincing email” into a “provable request.”
Use a call-back (or second-channel) verification for any request involving money, account changes, or sensitive data. It turns a “convincing email” into a “provable request.”
One last practical tip: if you ever feel a tiny flash of doubt—“Would my boss really ask me this way?”—treat that as useful information, not a nuisance. BEC succeeds by borrowing your momentum. Your best defense is giving yourself permission to pause and verify.