Skip to main content

BEC & Phishing Attacks on Merchants

TL;DR
  • BEC (Business Email Compromise) targets your employees, not your customers - attackers impersonate executives or vendors to redirect wire payments, with average losses of $137,000 per incident
  • The four attack types are vendor invoice fraud, CEO impersonation, payroll redirect, and credential phishing - all exploit process gaps, not technology vulnerabilities
  • Prevention is procedural: require out-of-band verification (phone call to known number) for any payment change or new vendor setup request received via email
  • Wire transfers are the primary target because they're irrevocable; ACH recall requests are more likely to succeed within 24 hours, but return is voluntary on the receiving bank's part - attackers know this and specifically request wire transfers

BEC (business email compromise) is fraud that targets your employees and vendors, not your customers. Attackers impersonate executives or suppliers to redirect payments to their accounts. The average loss is $137,000 per vendor invoice incident. Total reported losses came to $2.9 billion in 2023. Four attacks do most of that damage: vendor invoice fraud, CEO impersonation, payroll redirect, and credential phishing. Every one of them is a process problem, not a tooling problem.

CP vs CNP

BEC and phishing aren't channel-specific. They hit your back office whether you're CP or CNP. Wire fraud, payroll redirect, and vendor impersonation work the same in a retail store or an e-commerce site.

What Makes BEC Different​

Traditional Payment FraudBEC/Phishing
Fraudster uses stolen cardFraudster impersonates trusted party
Hits your checkoutHits your email/phone
Blocked by fraud rulesBypasses fraud rules entirely
Customer disputes afterwardYou authorize the payment yourself
Chargeback possibleWire is irrevocable

The key difference: In BEC, you authorize the payment. There's no chargeback, no dispute, no fraud rule that fires. You sent a fraudster the money yourself, and it's gone.

The Attack Types​

1. Vendor Invoice Fraud​

This one rides on a vendor you already pay:

  1. A fraudster maps your vendors: breach, social engineering, public info
  2. They build an invoice that looks like the vendor's
  3. It carries "updated banking information" for the payment
  4. You pay it, and the money's gone
  5. The real vendor calls later asking where payment went

Red flags:

  • "Updated bank account" or "new payment details"
  • Urgency: "Please update before next payment run"
  • Email address slightly off (vendorname@vendor-inc.com vs vendor@vendor.com)
  • Invoice format differs from usual
  • Request to not call usual contact to verify

Scale callout: At $500K+ in vendor payments monthly, you're a target. The more vendors you pay, the larger your attack surface.

2. CEO/Executive Impersonation​

This one runs on rank and hurry, not technology:

  1. A fraudster reads your execs off LinkedIn, your site, press
  2. They spoof the email, or take the account outright
  3. Finance gets an urgent note: "Wire $47,000 to this account for confidential acquisition"
  4. It's urgent, it's secret, and it skips the usual process
  5. The employee pays rather than look slow to the CEO

Common scenarios:

  • Fake M&A deals ("confidential, don't discuss with team")
  • Emergency vendor payments ("need this today")
  • Gift card requests ("buy $2,000 in gift cards for client appreciation, send codes to me")
  • Payroll adjustments ("add this contractor to next payroll run")

Red flags:

  • Request to bypass normal approval process
  • Unusual urgency
  • Request for gift cards (always a scam)
  • Emphasis on secrecy
  • Sender is traveling or "in meetings all day"

3. Employee Payroll Redirect​

This one is small money, which is exactly why it gets missed:

  1. A fraudster emails HR pretending to be your employee
  2. They ask payroll to point the direct deposit somewhere new
  3. The next paycheck lands in the fraudster's account
  4. The real employee asks where the money went

Red flags:

  • Email-only request (no phone confirmation)
  • New email address or slightly altered sender
  • Request shortly before payroll run
  • Employee recently promoted or transferred (more plausible reason for changes)

4. Credential Phishing​

Credential phishing doesn't take money, it takes the keys:

  1. An employee gets an email that looks like it's from your processor, bank, or an internal system
  2. The link goes to a login page that looks right
  3. The employee types the password in
  4. The fraudster is now inside your payment systems

Targets:

  • Processor admin portals
  • Banking platforms
  • Accounting software (QuickBooks, NetSuite)
  • Internal expense systems
  • Payroll platforms

Red flags:

  • Unexpected login prompts
  • URL doesn't match legitimate domain (paypa1.com, stripe-login.net)
  • Request to re-enter credentials for "security verification"
  • Threats of account suspension

The Numbers​

Attack TypeEstimated Average LossRecovery Rate
Vendor invoice fraud$125,00030%
CEO fraud$75,00025%
Payroll redirect$8,00040%
Credential phishingVariesN/A (data theft)

Per-subtype loss figures are industry estimates from multiple sources. The FBI IC3 reports an overall average of $137,000 per BEC incident but doesn't break down by subtype.

FBI IC3 2023 data: BEC caused $2.9 billion in reported losses. That made it the second-highest-loss category of internet crime, behind investment fraud at $4.57 billion. The real number is higher, because many attacks never get reported.

Prevention Framework​

Layer 1: Process Controls​

ControlWhat It Does
Dual approval for wiresTwo people must approve wire transfers
Callback verificationCall vendor at known number (not from email) before changing payment details
Out-of-band confirmationVerify unusual requests via different channel (call, Slack, in-person)
Payment change freeze48-hour delay on banking detail changes
No gift card policyNever buy gift cards for "business purposes" via email request

Layer 2: Technical Controls​

ControlWhat It Does
Email authentication (DMARC/DKIM/SPF)Harder to spoof your domain
External email banners"[EXTERNAL]" warning on emails from outside organization
Link protectionRewrite URLs to check reputation
MFA on all financial systemsStolen password alone isn't enough
Conditional accessBlock logins from unusual locations/devices

Layer 3: Training​

Focus AreaKey Points
Recognize urgency manipulationLegitimate requests can wait for verification
Verify before trustingCall known numbers, not numbers from the suspicious email
Report, don't ignoreBetter to report a legitimate email than miss an attack
Gift cards = fraudNo legitimate business request involves gift card codes via email

Test to Run​

30-day exercise:

  1. Audit your wire process - How many approvals, who can give them, and what gets verified?
  2. Review vendor payment changes - Pull the last 6 months and look for callbacks
  3. Check email security - Is DMARC enforced, and are external banners on?
  4. Run a phishing test - Send finance a simulated phish and count the clicks

Success criteria: zero single-approval wires, 100% callback verification on payment changes, and under a 10% phishing click rate.

Response Playbook​

If You Sent a Wire​

First 30 minutes are critical. Wire recovery success drops sharply after the first hour.

  1. Call your bank immediately (not email, not chat - phone)
  2. Ask them to recall the wire
  3. Give them the receiving account details from the wire
  4. File the FBI IC3 complaint at ic3.gov
  5. Call local law enforcement, get a report number
  6. Write down every step and the time

Recovery odds:

  • Within 24 hours: 30-40% partial recovery
  • Within 72 hours: 10-20%
  • After 1 week: under 5%

If Credentials Were Compromised​

  1. Reset every affected password, starting with the money systems
  2. Revoke active sessions on all of those accounts
  3. Turn on MFA anywhere it wasn't already on
  4. Read the access logs for anything you can't explain
  5. Check for new users, payment changes, or transactions you didn't make
  6. Tell any vendor or customer whose data was exposed

Where This Breaks​

Remote/distributed teams: Harder to verify in person. "Just call them" doesn't work when you've never met the person. Build verification processes that work remotely.

High employee turnover: New employees don't know what's normal. Onboarding must include security training and clear escalation paths.

Vendor-heavy operations: More vendors = more attack surface. The plumber who invoices you once doesn't have sophisticated security. Fraudsters know this.

Executive override culture: If executives routinely bypass approval processes, employees learn to comply with "urgent" requests. Culture must support verification.

Scale Callout​

Business SizeFocus
Under $1M revenueBasic controls: dual approval on wires, external email banners, no gift card policy
$1M-$10M revenueAdd callback verification, DMARC enforcement, phishing training
Over $10M revenueDedicated security awareness program, regular phishing simulations, vendor security assessments

Next Steps​

Setting up defenses?

  1. Implement dual approval for all wire transfers - Single point of failure is unacceptable
  2. Add external email banners - Simple, immediate impact
  3. Train finance team on verification - Callbacks to known numbers

Already been targeted?

  1. Review the attack for lessons - What failed?
  2. Update processes - Close the gap that was exploited
  3. Share anonymized details with industry peers - They're targets too

Building security culture?

  1. Run phishing simulations - Measure, don't assume
  2. Reward reporting - Make "I almost fell for this" a positive
  3. No blame for verification delays - Better slow and safe than fast and defrauded
Last updated on