Business Email Compromise: How It Actually Happens at a Small Firm

What is business email compromise?

Business email compromise is a scam where a criminal uses a business email account, either one they broke into or one they faked, to get someone to send money to the wrong place. The FBI’s 2025 IC3 Internet Crime Report defines it as a scam targeting businesses or individuals who regularly perform wire transfers, carried out “by compromising email accounts and other forms of communication… through social engineering or computer intrusion techniques to conduct unauthorized transfer of funds.”

The numbers are not small. In that 2025 report, IC3 counted 24,768 BEC complaints and $3,046,598,558 in reported losses. Only investment fraud cost more. In 2024 it was 21,442 complaints and $2,770,151,146. Over a longer window, the FBI’s PSA “Business Email Compromise: The $55 Billion Scam” put exposed losses at $55,499,915,582 across 305,033 incidents from October 2013 to December 2023.

I care about this term because of who it hits. Title companies move large wires between parties on a schedule anyone can guess. Law firms hold settlement and escrow money and send payment instructions by email all day. Two of the cases the FBI wrote up in the 2025 report are exactly that: a Missouri buyer who got wire instructions for over $1.3 million from a compromised “title company” email, and a couple closing on a home who wired over $449,000 after an email impersonating their attorneys.

How do attackers get in?

At a small firm, almost always through a password. Phishing, a reused password from some other breach, or plain guessing. Then the question is whether a second factor stops them.

That is where the gap usually is. Here’s the one I’ve seen up close. In our BEC wire fraud incident at a title company, the attacker logged into a closer’s Google Workspace inbox with her password and nothing else. The firm had come to us from a prior IT provider. Users could enroll in 2-Step Verification, and some had. But the tenant never had enforcement turned on, and Google only challenges for 2SV on suspicious sign-ins unless enforcement is on. The login didn’t look suspicious. So it went through on the password alone.

2SV enrolled is not 2SV enforced. That one setting is the difference between a single-factor account and a protected one.

Not every BEC needs a break-in, either. The FBI PSA’s tips include verifying the sender address and making sure links belong to the business they claim to come from, because a look-alike address can do the job without touching your mailbox. The 2025 report also names chat-written emails and voice cloning as BEC tools, and says businesses reported losses over $30 million to BEC scams involving AI. The playbook stays the same. The writing just gets better.

What does the fake email look like?

It looks like a normal email from someone you already work with, about a deal you already know is happening. That’s the whole trick.

In our title company case the attacker:

1. Sent a harmless note about a real pending closing first, likely to confirm the inbox was live.
2. Seventeen minutes later, sent “updated” wire instructions to the closing agent on the other side of that deal, in the closer’s own tone.
3. Two hours after that, created mail filters that blocked email from the firm’s funding desk and from another closer who would have spotted it.

That third step is what most people miss. BEC attackers don’t send one email and leave. They stay logged in and watch. If the other side replies “are these new instructions real?”, the attacker wants to see it and answer it first, while keeping coworkers out of the thread.

Things worth treating as a red flag, every time:

• Any change to wire or payment instructions, especially close to a deadline.
• Urgency or secrecy: “funding is today,” “please don’t call, I’m in a meeting.”
• A sender address or link that is one character off from the real one.
• A thread that suddenly goes quiet on your side when you expected replies.

What stops it?

A phone call. Specifically, a call to a number you already had on file, before any money moves on changed instructions. The FBI’s first prevention tip in its BEC PSA is to use secondary channels or two-factor authentication to verify requests for changes in account information. Email can’t verify email. If the inbox is owned, the attacker answers.

The rest is the layer that keeps them out of the inbox in the first place:

• Enforce MFA at the tenant level, not just “available.” Check the setting on every Microsoft 365 or Google Workspace tenant you inherit.
• Use phishing-resistant MFA for the people who move money. CISA’s phishing-resistant MFA fact sheet points to FIDO/WebAuthn, which in practice means hardware security keys.
• Unique passwords from a password manager, so one breached site doesn’t hand over your mailbox.
• Watch for inbox rules and forwarding on accounts that touch payments. A new rule that hides mail from your own funding desk is not normal.
• Write the wire rule down. Any change to payment instructions gets a phone call to a known number. No exceptions for the partner who’s in a hurry.

If money already left, speed matters more than anything. The 2025 IC3 report says to contact your financial institution immediately and request a recall, then file at ic3.gov with full transaction details, because IC3’s Recovery Asset Team can ask banks to freeze funds. In the $449,000 case above, the full amount was still on hold at the receiving bank after IC3 stepped in.

What we did when it happened to a client

The title company’s owner called us and said, “People are sending emails from her actual account changing wiring instructions, we need to shut down whoever it is.” The full write-up is in the BEC wire fraud incident report. The short version:

• Forced a password change and killed every active session, so any stolen cookie died with it.
• Removed the two block rules so internal email flowed again.
• Went through sent mail, found every message the attacker sent, and phoned the other side’s closer to tell them to disregard the fake instructions.
• Checked for the worse possibilities: no OAuth apps, no app passwords, no forwarding rules, no malware on the laptop. Credential-only compromise.

The phone call is what saved the money. The wire was never sent. Zero funds lost on a high-six-figure transfer, contained in about two and a half hours. The owner calling us right away instead of trying to sort it out internally mattered just as much.

The same day, we turned on org-wide 2SV enforcement and started our managed security baseline on that tenant: hardware keys for funding staff, context-aware access blocking high-risk geographies, Advanced Protection for executives, and the written phone-verification rule for any wire change.

Key takeaways

What this looks like when we do it

Every tenant we fully take over gets that baseline on day one, not after an incident. Enforced MFA for everyone. Hardware keys for whoever touches funding. A written wire-verification rule your staff can point to when someone pushes back. And on any account that looks wrong, we check rules, filters, forwarding, OAuth apps, and sessions, because that’s where BEC hides.

We work with title companies, law firms, and other regulated firms of 5 to 100 users in Knoxville and East Tennessee. Critical issues get a response in under 15 minutes. If you inherited a Microsoft 365 or Google Workspace tenant and nobody has checked whether MFA is actually enforced, contact us and we’ll look at it with you.