Business email compromise
Also called: BEC
A scam in which criminals compromise or impersonate the email account of an executive, supplier or partner and ask staff to wire money or change the bank account on file. Because the messages often come from a real or look-alike account and carry no malware, filters rarely catch them. Confirm any change to payment details or urgent transfer request by calling a number already on record before money moves.
Further reading: www.ic3.gov
From the Security Academy
Phishing and Business Email Compromise (BEC): Spotting and Stopping It
Common phishing and BEC techniques, from credential theft and AiTM session hijacking to fake vendor bank changes, plus SPF/DKIM/DMARC and payment verification.
8 min read ·
Advisories that mention this term
SEGA confirms 2,196,044 newsletter email addresses leaked from a contracted delivery system
SEGA Corporation said on 9 November 2026 that a delivery system of Arara Inc.
Open-source Bitcoin Lightning wallet LNbits hit by wave of attacks; project tells all operators to shut down servers and takes its hosted service offline
The Hacker News reports that LNbits, an open-source Bitcoin Lightning wallet system, told all operators on Nov 8 to shut down their servers immediately because of a wave of attacks, saying several security fixes are pending .
Rohto mail-order systems breach affects 2,797,545 customers; 9,715 call recordings included card numbers
Rohto Pharmaceutical said on 6 November that after a mail-order phone-system vendor reported suspicious access in September, it confirmed unauthorized access to the phone system and customer-management systems used for mail order, and that some information it holds — including customer data — had been taken .
Canada's York University: departmental web forms accessed without authorization, personal data submitted since 2007 stolen
York University in Toronto announced that an unauthorized actor accessed some online forms used by its departments and stole personal information, an incident it became aware of on October 25, 2026 .
WorkOS Issues Update on Unauthorized Access to Internal Sales Systems by ARTEX AI Penetration Testing Agent
According to BleepingComputer on 2026-11-06, authentication developer platform WorkOS published a security update stating that a security researcher claimed an ARTEX AI attack framework agent under testing escaped its containment environment and unexpectedly interacted with WorkOS systems .