How business email compromise (BEC) scams work
Criminals break into or imitate the email of an executive, vendor, title company, or client. They send a convincing request to change payment details or send an urgent transfer. Funds are sent to accounts the criminals control, and IC3 has seen more BEC payments sent to crypto exchanges and similar accounts. AI tools can make these emails and even voice calls sound more realistic. Once funds are converted to crypto and moved, recovery becomes harder.
Warning signs of a BEC scam
- A request to change bank details or pay by crypto, sent by email only.
- Urgent, confidential payment requests from an executive who is 'unavailable'.
- Sender addresses or domains that differ by a letter from the real one.
- A vendor suddenly asks to be paid to a crypto exchange or a new account.
- Email rules or forwarding you did not set up.
- A voice or video call that seems slightly off and pushes for a quick transfer.
How to prevent BEC payment fraud
- Verify any payment change by calling a known phone number, not one in the email.
- Require two people to approve new payees and large transfers.
- Turn on multi-factor authentication for all business email accounts.
- Train staff to check sender addresses carefully, especially on phones.
- Monitor accounts and email settings for unusual changes.
Sent a payment to a BEC scammer? What to do now
- Call your bank immediately to request a recall of the funds; time is critical.
- If crypto was involved, contact the receiving exchange with transaction details.
- File a complaint at ic3.gov with full transaction details, and report to the FTC at reportfraud.ftc.gov; IC3 may help freeze funds.
- Preserve evidence before anything disappears: screenshots of chats, profiles, websites and app screens, plus receipts, emails, and a written timeline. Do not delete conversations or the app. Keep email headers and do not wipe compromised accounts before investigators review them.
- Secure the compromised email account and review what else the attacker accessed.
- Watch for recovery scams. Anyone who contacts you offering to get your crypto back for an upfront fee, or who claims to work with the FBI or IC3, is likely a scammer. IC3 says it will never ask for payment to recover lost funds or refer you to a company that does. See /guidance/can-stolen-crypto-be-traced.
Business email compromise: common questions
A vendor emailed asking us to pay to a new account or a crypto exchange. What should we do?
Verify it by calling the vendor on a phone number you already have, not one in the email. Requests to change payment details by email only, or to pay a vendor in crypto, are the classic warning sign.
We already sent the payment. Can it be recalled?
Call your bank immediately and ask for a recall; time is critical. File a complaint at ic3.gov with full transaction details straight away, and if crypto was involved, contact the receiving exchange with the transaction details.
Should we reset or wipe the compromised email account?
Secure it (change passwords, turn on multi-factor authentication, remove unknown forwarding rules), but don’t wipe it. Keep email headers and logs so investigators can review what happened.
The request came by voice or video call from our CEO. Could that be fake?
Yes. AI tools can imitate voices and faces. If a call pushes for an urgent or secret transfer, verify it through a separate channel you trust before paying.
BEC statistics
- IC3 received 1,526 business email compromise complaints with a cryptocurrency connection, with $83,771,329 in reported losses, in 2025. (source)
- IC3 recorded $55.5 billion in exposed BEC losses worldwide from October 2013 to December 2023 (all payment methods). (source)
This guide is general information, not legal or financial advice. ChainWatch is not a law firm and does not guarantee fund recovery.
Sources
The information on this page was checked against the sources listed in September 2026. Laws, agency guidance, company policies and contact details change, so please verify the current information with the original source before you act.