What is business email compromise?

Business email compromise is a scam that misuses a business email identity to make a request look genuine. Criminals may control a real mailbox or imitate its sender, often requesting payments or changed bank details. CEO fraud is a version where the message appears to come from the boss. 12

By Secordit. Last checked: 7 November 2026.

Go to the steps · All glossary terms

How it works

  1. The criminal studies or imitates a business relationship. 12
  2. A message appears to come from a supplier, colleague or director. 12
  3. The recipient is asked to pay or change payment details. 12

Real UK example

Report Fraud's September 2026 warning described criminals impersonating suppliers, colleagues and service providers. It said compromised email accounts were used to make requests appear genuine.

UK Finance also treats CEO fraud as a separate payment-scam category. The warning described reported methods rather than naming a victim company. 12

Warning signs

  • The boss asks for an unusual payment in confidence. 1234
  • A normal approval step is suddenly described as unnecessary. 12
  • An email conversation introduces different bank details. 1234
  • The sender address or writing feels slightly wrong. 12

What to do now

  1. Verify the request using a known phone number or another trusted channel. 12
  2. If your mailbox was misused, ask your IT provider to help secure it. 12
  3. Check forwarding rules and recovery details through the genuine email service. 12567

UK reporting and support

  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 348
  • Report fraud or hacking in England, Wales or Northern Ireland to Report Fraud. In Scotland, call Police Scotland on 101. 49
  • If someone is in danger, call 999. 9

How to protect yourself

  • Apply the same payment checks to requests from senior staff. 1234
  • Turn on two-step verification for business email. 12567
  • Make checking unusual instructions an accepted part of the job. 12

Frequently asked questions

Is CEO fraud the same as business email compromise?

CEO fraud is a version involving an impersonated executive. BEC also covers supplier and other business-email impersonation. 21

Does BEC always mean our mailbox was hacked?

No. Criminals may use a convincing impersonation email instead of taking over the real account. 1

What should staff do with an urgent payment email?

Pause and verify it using established contact details. An urgent tone is not a reason to skip checks. 1

Read the longer guide

Matching kit

Bank Details Changed? · £19 · Digital download.

A call-back rule, script and bank-change log for small teams. It does not decide whether a payment is genuine.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. Report Fraud, Criminals steal £101 million through Payment Diversion Fraud as City of London Police issues warning to businesses and the public - Report Fraud. Accessed 7 November 2026 (Europe/London).
  2. UK Finance, UKFINPDF. Accessed 7 November 2026 (Europe/London).
  3. UK Finance, Authorised Push Payment Fraud Reimbursement | UK Finance. Accessed 7 November 2026 (Europe/London).
  4. Report Fraud, Report Fraud alert: Police forces being impersonated in scam calls using ‘spoofed’ phone numbers - Report Fraud. Accessed 7 November 2026 (Europe/London).
  5. NCSC, Recovering a hacked account | National Cyber Security Centre. Accessed 7 November 2026 (Europe/London).
  6. NCSC, Top tips for staying secure online | Turn on 2-step verification (2SV) | National Cyber Security Centre. Accessed 7 November 2026 (Europe/London).
  7. ICO, 23andMe fined £2.31 million for failing to protect UK users’ genetic data | ICO. Accessed 7 November 2026 (Europe/London).
  8. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 7 November 2026 (Europe/London).
  9. Police Scotland, How to report a crime - Police Scotland. Accessed 7 November 2026 (Europe/London).