Business email compromise (BEC): كيف يعمل وعلامات التحذير وماذا تفعل
Business fraud · alto
In BEC, the criminal uses a corporate email account, hacked or spoofed, to trick someone into making a payment or sending data. The intrusion usually starts with credential phishing; the attacker then reads the inbox for days or weeks to learn who approves payments and how people write.
At the right moment, from the compromised mailbox or a look-alike domain (examp1e.com instead of example.com), they send an urgent request: pay an invoice, change bank details, buy gift cards or send payroll data. Attackers often add forwarding rules that hide replies from the real owner.
The FBI IC3 received 24,768 BEC complaints in 2025, with about US$ 3.05 billion in US losses. APWG reported an average requested BEC wire amount of US$ 50,297 in Q4 2025.
Sinais / Signs
- Urgent payment or account-change request, with a request for secrecy
- Sender domain with one character swapped or a different extension
- The Reply-To address differs from the sender
- Tone or signature slightly different from usual
- Requester unavailable by phone ("in a meeting, email only")
- Forwarding or filter rules nobody remembers creating
Prevenção / Prevention
- Require phishing-resistant MFA on all email accounts
- Confirm any new payment or data change by phone, using a number already on file
- Use dual approval for transfers above a threshold
- Set up SPF, DKIM and DMARC and tag external emails
- Monitor mailbox rules and logins from unusual locations
- Train finance and executives with real examples
O que fazer / What to do
- Call your bank immediately and request a wire recall
- In the US, file with IC3 as soon as possible: the FBI Recovery Asset Team acts on recent wires
- Reset passwords, revoke sessions and remove suspicious mailbox rules
- Preserve emails with full headers and logs
- Warn clients and vendors who may have received fake messages
- In Brazil, file a police report and assess notifying the ANPD if personal data was exposed
FAQ
Is BEC the same as phishing?
No. Phishing is usually mass and aims at credentials. BEC is targeted and seeks a specific payment or data, often using an account already compromised by phishing.
Are small businesses targeted too?
Yes. They often have fewer approval controls, which makes the scam easier.
Radar
- — Business email compromise costs US firms US$3.05bn · US$ 3,05 bi. IC3 received 24,768 BEC complaints in 2025, with losses of US$3,046,598,558. المصدر: FBI IC3 2025 (cópia do PDF via PPC Land)
FBI IC3 - Internet Crime Complaint Center · FBI IC3 2025 Internet Crime Report (PDF, cópia) · APWG Phishing Activity Trends Report Q4 2025 · CERT.br · ANPD