Why business email compromise belongs to the payments team

The week

A controller at a mid-sized manufacturer gets an email from a long-standing supplier. It is part of a real conversation about a real invoice. The tone is familiar, the signature is right, and the message simply notes that the supplier has changed banks and gives new account details. The controller updates the record and pays. Weeks later, the real supplier calls to ask where its money is.

That is business email compromise, or BEC: criminals impersonate executives, vendors or other trusted parties to redirect payments. It rarely involves clever hacking in the movie sense. It works by persuading a real person to send real money to the wrong place.

In mid-March 2021, the FBI’s Internet Crime Complaint Center (IC3), the bureau’s central intake point for reports of online crime from victims, released its 2020 Internet Crime Report. It recorded 791,790 complaints, up sharply on the previous year, with reported losses of more than $4.1 billion.

Within those numbers, one category stood out again. BEC accounted for the largest reported losses of any category: about $1.8 billion from roughly 19,000 complaints. A relatively small number of incidents produced a very large share of the money lost, because each successful BEC tends to involve a sizable business payment rather than a small consumer purchase.

The concentration was striking. BEC made up fewer than one in forty of the complaints in the report, yet it accounted for more than two-fifths of the reported losses. The FBI had already signaled the scale of the problem. A 2019 public service announcement put global exposed losses from BEC between mid-2016 and mid-2019 at about $26 billion.

The report’s figures also had a known limit. They counted only what victims chose to report to the IC3. Many businesses that lose money to fraud never file a complaint, for reasons ranging from embarrassment to a belief that nothing will come of it. The reported losses were a floor, not a full count.

The IC3 files these cases under a combined heading, business email compromise and email account compromise. The second term covers the same scheme aimed at individuals rather than companies. Both depend on the same two techniques: spoofing a trusted sender, or taking over the trusted sender’s real mailbox.

The FBI had been warning about the scheme for years. Its public service announcements described the recurring variants. They included fake invoices from suppliers, urgent wire requests from someone posing as the chief executive, requests to redirect an employee’s payroll deposit, and altered wiring instructions for real estate closings. The Treasury Department’s Financial Crimes Enforcement Network, known as FinCEN, had issued advisories to financial institutions on BEC in 2016 and again in 2019. It asked banks to flag suspected cases in their suspicious activity reports with a specific key term, so the cases could be tracked.

Ransomware, the malicious software that locks up an organization’s files until a ransom is paid, drew more headlines that year, with its dramatic shutdowns of hospitals, schools and city halls. But BEC caused far more reported loss. The 2020 report recorded about 2,500 ransomware complaints with reported losses of roughly $29 million. Ransomware’s true cost was certainly higher, because reported losses leave out downtime and recovery, and many victims never file. Even so, the gap was wide. BEC makes less noise, and crimes that make less noise tend to get less attention in boardrooms than they deserve.

The year behind the report mattered too. In 2020, most office staff moved home. The habits that had once caught a suspicious request, such as walking over to ask a colleague or checking with the person at the next desk, disappeared. Approvals moved into email and chat. Vendors changed banks, addresses and contacts as they adapted to the pandemic, which made a message announcing new bank details look ordinary.

The report also described the IC3 Recovery Asset Team, which works with financial institutions to freeze fraudulent domestic transfers when victims report quickly. The team had been set up in 2018 for exactly this purpose. That detail matters more than it might seem. It means that what happens in the first hours after a fraud is discovered can decide whether the money comes back.

For banks, credit unions and the businesses they serve, the week’s report carried a simple message: the biggest fraud losses were not coming from exotic technology. They were coming from ordinary payment processes that trusted an email.

BEC is usually filed under cybersecurity, and email security vendors sell directly against it. That filing is understandable and incomplete. The loss does not happen in the inbox. It happens when a payment instruction is changed and a payment is released.

For banks, credit unions and their business customers, the problem divides into three control points in sequence. The first is the instruction: how a request to pay, or to change payment details, is verified. The second is the release: how the payment system decides whether to send. The third is the recovery: what happens in the first hours after fraud is discovered. Email filtering touches only the first, and only partly.

The three points have different owners. The instruction belongs mainly to the business customer, its accounts payable team and its treasury staff. The release is shared between the customer’s own approval settings and the institution’s payment controls. The recovery belongs mainly to the institution’s fraud operations and its counterparts at the receiving bank. A program that assigns all three to the security team misses two of them.

Financial institutions sit on both sides. They are payment providers for business clients who are targeted, and they are businesses themselves, with their own vendors, invoices and payroll. The controls below apply in both roles, though the levers differ.

How the money actually moves

Where BEC can be stopped depends on the basic plumbing of business payments.

A wire transfer is a direct, bank-to-bank movement of money, typically used for large or urgent payments. Wires are fast, often settling the same day, and once they arrive they are hard to reverse. That speed is exactly why criminals like them.

ACH, short for Automated Clearing House, is the network that handles batched electronic payments in the United States: payroll direct deposits, vendor payments, bill payments. ACH payments have historically been slower and more reversible than wires, but they move huge volumes, and payroll or vendor redirection fraud often runs through them.

Inside a business, a vendor master file is the list of suppliers and the bank details the company pays them with. Change one line in that file and every future payment to that supplier goes somewhere new. Many companies also use a treasury platform, the online banking system their bank provides for business clients, to create, approve and send payments.

Finally, a money mule is a person, sometimes a knowing accomplice and sometimes a deceived one, whose bank account receives stolen money and passes it on. Criminals need mule accounts because they cannot simply ask victims to wire money to an account in their own name.

With that vocabulary, the three control points become clear. The instruction is where someone tells the business where to send money. The release is where the bank decides whether to send it. The recovery is what happens when everyone realizes the money went to a mule.

Faster rails, shorter windows

The payment rails were changing in ways that mattered for BEC. Same Day ACH had been expanding since 2016, and its per-payment limit rose to $1 million in March 2022. The Clearing House’s RTP network had offered instant payments since 2017, and the Federal Reserve was building its own instant service, FedNow, which launched in July 2023.

Instant payments settle in seconds and are final. Speed is a real benefit for legitimate businesses. It also removes the window in which a bank, a customer or a recovery team could stop a fraudulent payment. As more business payments move to faster rails, the controls at the instruction and the release carry more of the weight, because the recovery window shrinks toward zero.

The scheme, step by step

The cases that cause the largest losses tend to follow a pattern. A criminal first gains access to a mailbox, often through a phishing page that harvests a password, or by reusing a password leaked elsewhere. The mailbox may belong to the victim business, to a supplier, or to a professional such as a lawyer or escrow agent.

The criminal then reads. Weeks of patient observation show who pays whom, when invoices fall due, how people write and who approves what. Many attackers create mailbox rules that divert replies from certain senders into hidden folders, so the real account holder never sees the conversation.

At the right moment, the criminal sends a message from the compromised mailbox, or from a lookalike domain inserted into the thread. It asks for a change of bank details, an urgent payment or a rush on a closing. The payment goes to an account the criminal controls, usually a mule account at a domestic bank. From there the money is moved on quickly, often in pieces, abroad or into crypto assets.

Each step leaves traces, but in different places. The mailbox compromise shows up in sign-in logs. The diversion rules show up in mailbox settings. The payment change shows up in the vendor master file. The mule shows up at the receiving bank. No single team sees all four.

The instruction: verifying changes, not messages

Most BEC losses follow a request that looks routine: a vendor’s new bank account, an executive’s urgent wire, a payroll redirection, a real estate closing with updated wiring instructions.

Email authentication standards such as SPF, DKIM and DMARC make it harder to spoof an organization’s own domain. In everyday terms, these are technical checks run by the receiving email system. They confirm that a message claiming to come from examplebank.com really came from that bank’s authorized mail servers, rather than from an impostor. They work like a tamper-evident seal on an envelope. Impersonation detection catches many lookalike domains, such as examp1ebank.com with a number one in place of the letter L. Those controls cut the volume of attempts.

They do not stop the cases that cause the largest losses. When a genuine vendor or customer mailbox has been taken over, the fraudulent message arrives from a trusted address, often inside an existing thread about a real invoice. The email is authentic in every technical sense. The seal on the envelope is genuine because the criminal is using the real envelope. Only a process outside email can show that the instruction is not.

The effective control is procedural. Any change to payment details is confirmed through an independent channel using contact information already on file, never details supplied in the request. If the email says “call me at this number to confirm,” that number is the one place you must not call. A good implementation adds a cooling-off period before the first payment to a changed account, and requires a second person to approve the change in the vendor master file.

This fails less from ignorance than from ownership. Accounts payable owns vendor records, treasury owns wires, and IT owns email. A verification rule that sits between those three teams needs one owner with authority to enforce it, and an audit that samples changes each month to confirm the callback happened. Without the audit, the rule tends to erode under the pressure of month-end deadlines and impatient vendors.

Designing a callback that holds up

A callback rule is only as strong as its details. The versions that hold up under pressure share several features:

• The number comes from the file, not the message. The contact used is the one recorded when the vendor was onboarded, or in the original contract.
• The call confirms the specific change. The caller reads back the old and new account details and asks the vendor to confirm both, rather than asking whether “everything is in order.”
• The evidence is recorded. The record shows who called, which number, when, who answered and what was confirmed.
• A second person approves. The change takes effect only after someone other than the requester reviews the evidence.
• The first payment is watched. The first payment to a changed account is held for a short period or reviewed by a supervisor.
• Exceptions need a senior signature. Nobody can skip the process because a vendor or an executive says it is urgent.

Payroll diversion needs its own version of the rule. In that variant, a criminal posing as an employee asks HR or payroll to change where a paycheck is deposited. The defense is to accept direct deposit changes only through an authenticated employee self-service system, never by email. The employee should be notified at the old contact details when a change is made, and the first deposit to a new account can be flagged for review.

Some businesses go further, moving vendor bank changes into a supplier portal where the vendor must log in with multi-factor authentication. That removes email from the change process altogether. It costs more to set up and needs vendor cooperation, which is easier for a large buyer than for a small one.

How the instruction risk differs by institution

A community bank or credit union often knows its commercial clients personally. That makes education and setup conversations easier, but its clients are typically small businesses with one bookkeeper and no separate treasury function. Segregation of duties is hard when the business has two employees.

A larger regional bank serves more mid-sized companies with formal accounts payable teams. Their exposure is higher in amount and more often concentrated in vendor payment changes. The bank’s lever is the treasury platform and the onboarding process for new commercial clients.

Title companies, law firms and escrow agents form a category of their own. They move large sums on behalf of others, often to parties they have never dealt with, under fixed closing dates. Real estate closings have been a persistent BEC target for that reason. Their banks can help by treating changes to closing wire instructions as high-risk events by default.

The objection: a phone call can be faked too

A fair objection is that callbacks are weaker than they look. Phone numbers can be spoofed, mobile accounts can be hijacked, and by 2024 voice cloning made it possible to imitate a known person convincingly.

The objection strengthens the argument rather than defeating it. Each of those attacks targets a channel the criminal chooses or controls. A callback to a number already on file, initiated by the payer, forces the criminal to control a channel they did not set up. Adding a second confirmation channel for high-value changes, such as a known contact at the vendor’s accounts receivable office, raises the bar further. What fails is a callback the criminal arranged.

The release: where institutions add friction

Financial institutions sit at the second control point. They see the payment, not the email. That limits what they know without leaving them blind. A first-time beneficiary, a new account at a different institution, an unusual amount or timing, or a beneficiary account opened recently can each justify a hold, a callback or an extra approval.

The receiving side matters too. An institution that notices a newly opened account receiving large business payments inconsistent with its stated purpose may be looking at a money mule. A personal checking account opened last month that suddenly receives a six-figure payment labeled as an invoice settlement deserves a second look.

For commercial customers, the most useful tools are often already in the treasury platform:

• Dual approval for new beneficiaries, so one person cannot add a new payee and pay them alone.
• Separate entitlements for creating and approving payments, meaning different people hold the “prepare” and “send” permissions.
• Payment templates that cannot be edited without re-approval, so a trusted recurring payment cannot be redirected unnoticed.
• Alerts to a second contact when templates change, so someone other than the person making the change hears about it.

Many customers had these features and had not turned them on. Configuring them with business clients was, and remains, one of the highest-value fraud conversations a bank or credit union can have. It costs the institution little more than a meeting, and the tools are already paid for.

The trade-off is friction. Every hold delays a legitimate payment for someone, and relationship managers hear about it. Institutions that handled this well tuned holds to risk, explained them to clients in advance, and measured false positives, legitimate payments wrongly flagged, so that the rules stayed credible. A rule that stops every payment is soon ignored or overridden. A rule that stops the right ones earns trust.

Why the account name rarely saves the payment

A business paying a supplier usually enters both the supplier’s name and an account number. Many people assume the receiving bank checks that they match. Often it does not.

Article 4A addresses the case where a payment order names one person but gives an account number belonging to another. The beneficiary’s bank may generally rely on the number, if it does not know of the mismatch. Automated systems post by account number. A payment addressed to a long-standing supplier but carrying a mule’s account number goes to the mule.

The United Kingdom introduced a name-checking service, Confirmation of Payee, from 2020, which warns the payer when the name and account do not match. The United States had no equivalent universal service in 2021. Account validation services offered by private networks have since grown, and they can be built into vendor onboarding and treasury platforms. Where available, they give the payer a check at the release point that email security cannot.

Watching the receiving side

Every BEC payment lands in an account at some institution. That institution has its own obligations under anti-money laundering rules: to know its customers, to monitor accounts and to file suspicious activity reports. Mule accounts often show recognizable patterns. They are recently opened, receive large credits that do not fit the stated purpose, and move the money out quickly.

Monitoring for those patterns is the receiving bank’s contribution to stopping BEC. It also protects the receiving bank, which can face reputational damage and regulatory questions if its accounts are used repeatedly by fraud rings. Credit unions with open membership and banks with fast online account opening are especially exposed to mule recruitment.

The objection: friction drives clients away

Treasury sales teams sometimes argue that holds and extra approvals push clients to competitors with smoother service. Fintech payment providers advertise speed.

The answer is calibration, not abandonment. Holds aimed at first payments to new beneficiaries and changed templates affect a small share of payments. Most business payments go to the same payees every month. A client who loses a large payment to fraud is far more likely to leave than one who waits a few hours for a confirmed first payment. Institutions that explain the controls during onboarding, rather than during the first hold, meet much less resistance.

Who carries the loss, and why that is the wrong question

Liability shapes the incentives. For commercial wire transfers, Article 4A of the Uniform Commercial Code, the body of state law that governs these payments, treats a payment order the customer itself authorized as the customer’s own order. Separately, a bank that followed a commercially reasonable security procedure agreed with the customer is generally protected even when the customer later disputes an order.

A BEC victim usually did authorize the payment, having been deceived about where it was going. The controller in our opening example really did log in and approve the wire. Banks are therefore often not legally liable, and some treat BEC as the client’s problem.

Courts have looked hard at security procedures in disputes over orders the customer says it did not authorize. In Choice Escrow and Land Title v. BancorpSouth Bank, decided by a federal appeals court in 2014, the customer had declined the bank’s offer of dual control. The court found the bank’s procedure commercially reasonable and left the loss with the customer. The case involved a hijacked online banking session rather than a deceived employee, but it shows why documented offers of controls matter.

Consumer protection rules offer little here. The Electronic Fund Transfer Act and Regulation E protect consumers against unauthorized electronic transfers, but they exclude wire transfers and do not cover business accounts. A small business that loses a payment to BEC is usually on its own under the law, whatever its size.

That is a commercial mistake. Clients who lose six figures to a fraud their bank could have flagged rarely stay, and disputes over whether a security procedure was commercially reasonable are costly even when the bank wins. For a community bank or credit union, where relationships are the business, losing a long-standing commercial client over a fraud the institution could have helped prevent is a real and lasting cost. Organizations should check the specifics with counsel.

A different model abroad

Other countries have chosen differently. In the United Kingdom, mandatory reimbursement for authorized push payment fraud took effect in October 2024. It covers consumers, micro-enterprises and charities up to a cap, and splits the cost between the sending and receiving payment firms. Larger businesses are not covered.

The UK model shows the policy option, and its critics argue it reduces victims’ incentive to be careful. Neither point changes the operational argument. Wherever the loss lands, the controls that prevent it are the same three. Liability decides who pays for failure. It does not decide whether the failure happens.

The recovery: the first hours decide the outcome

The third control point is time. The IC3 report highlighted the Recovery Asset Team’s work with receiving institutions to freeze funds, which depends on a fast report. Once money moves onward, especially abroad or into crypto assets (digital currencies that can be moved quickly across borders outside the traditional banking system), recovery becomes much less likely.

That makes recovery an operations question rather than a technology one. Four conditions decide it:

• A customer can report suspected wire fraud at any hour and reach someone who can act.
• Branch and call center staff escalate immediately instead of opening a routine ticket.
• The fraud team has a current contact list for counterpart teams at receiving banks.
• A template recall request is ready to send, so nobody is drafting it from scratch at 6 p.m. on a Friday.

Institutions that met all four turned some BEC losses into near misses. A recall request is the formal message asking the receiving bank to return or freeze funds sent in error or by fraud. It is only useful if the money is still there to freeze.

The first-hour sequence

When a business client calls to report a fraudulent payment, the useful sequence is short and fixed:

1. Capture the payment details. Amount, date, time, rail, reference number and the receiving bank and account.
2. Contact the receiving bank directly. Use the fraud contact list, not the general customer line, and ask for a freeze pending investigation.
3. Send the formal recall. Use the pre-written template through the payment network’s messaging channel.
4. Tell the client to report to the FBI. A complaint to IC3, filed promptly, is what allows the Recovery Asset Team or, for international wires, the FBI’s Financial Fraud Kill Chain process to engage.
5. Secure the client’s accounts. If the client’s mailbox was compromised, the criminal may try again, so payments and template changes should be locked down.
6. Document and file. Record each step and its time, and consider whether a suspicious activity report is required.

A receiving bank is not always obliged to return funds once a payment has been accepted. Returns may depend on the account holder’s consent, the receiving bank’s own account terms or legal process. A freeze buys time for those to work. Speed therefore matters more than paperwork in the first hour, and why the paperwork should be ready in advance.

After the recovery attempt

Whether or not the money comes back, the client needs help with the aftermath. Its mailbox should be examined and secured, including forwarding and inbox rules the criminal may have created. Its suppliers and customers may need to be told, because the same criminal can use the compromised mailbox to target them. Its insurer usually needs prompt notice, since many policies set short deadlines for reporting a loss.

An institution that walks a client through these steps turns a bad day into evidence of a good relationship. One that ends the call after taking the recall details leaves the client to work it out alone, often while the criminal is still in its mailbox.

Practice, not policy

A recovery path that has never been tested usually fails on a detail: a contact who left, a template stored on someone’s laptop, a call center script that routes fraud to a business-hours queue. Institutions that run a short exercise each quarter, using a simulated client call after hours, find those details before a real fraud does.

A loss that lands well beyond the security budget

It is easy for a CEO or board to hear “email fraud” and assume it is a matter for the IT department and the security budget. The numbers in the IC3 report argue otherwise, and so does the way the losses fall.

Money. Each successful BEC tends to involve a large business payment. A single redirected vendor payment or real estate closing can wipe out a year of profit for a small business client. The institution bears costs even where the law places the loss on the customer. There are investigation costs, staff time, legal fees if the dispute escalates and, most importantly, the lifetime value of the relationship at risk.

Insurance. Many businesses assume their cyber policy covers a fraudulent payment. Coverage depends on the wording. Social engineering losses are often covered only by a specific endorsement, under a crime or cyber policy, and frequently with a lower sublimit than the main policy. Some policies require the insured to have followed a verification procedure for coverage to apply. A bank or credit union that encourages commercial clients to check their coverage before a loss is giving them useful advice.

Customers. Business clients judge their bank or credit union in moments like these. A member who loses money and then struggles to reach anyone who can help will remember the second experience as vividly as the first. A member whose bank caught the fraud, or recovered the money quickly, becomes an advocate.

Regulators and examiners. Supervisors expect institutions to manage fraud risk across the whole payment process, including but well beyond their own email systems. The controls described here, from dual approval to monitoring receiving accounts, are the kind of evidence that shows a fraud program is working rather than merely written down.

Staff. BEC succeeds by exploiting good intentions: the bookkeeper who wants to pay a supplier on time, the assistant who wants to help an executive under pressure. Clear rules protect those people. “I can’t change bank details without a callback, it’s policy” is a much easier sentence to say than “I don’t trust you.” Without the rule, staff are left to make judgment calls under pressure, and to carry the blame when they get one wrong.

Reputation. In community banking especially, word travels. A local business that lost money and felt brushed off will tell its peers. So will one that was saved by an alert phone call.

Two credit unions, one fraud

Take a regional credit union with a strong small-business membership. One of its members, a construction firm, receives an email from a real supplier’s compromised mailbox announcing new bank details.

At the first credit union, the firm’s bookkeeper updates the vendor record and sends a large ACH payment. The credit union has never discussed dual approval with this member, so nobody else sees the change. The receiving account was opened recently at another institution. Nothing flags. The fraud surfaces two weeks later. The member calls the general line, waits on hold, and is told to file a dispute form. By the time a recall request goes out, the money is long gone. The credit union is probably not legally liable. It loses the member anyway, and the story travels through the local business community.

At the second credit union, a relationship manager walked the same member through its treasury platform the previous year. Adding a new payee now requires a second approver, and the firm’s owner gets an alert. The owner calls the supplier on the number in the original contract and learns that nothing has changed. The payment never goes. Had it gone, the credit union’s fraud line would have answered at any hour, and a recall template and current contact list would have been ready. Same fraud, same technology. Different outcome, because the control points had owners.

The second credit union also benefits afterward. Its fraud team tells the supplier that its mailbox appears compromised, which protects the supplier’s other customers. It files a report, adds the receiving account details to its internal watch list and shares the pattern through its industry information-sharing channels. The near miss becomes intelligence. At the first credit union, the same fraud left nothing behind but a lost member.

Who should own BEC, and how to measure it

Seeing BEC this way moves ownership. It belongs with the executive who runs payment operations and fraud, supported by security. Security still matters: it hardens email, trains staff and investigates compromised mailboxes. But the decisions that stop losses are payment decisions.

It also changes the metrics. Counting blocked phishing emails says little about losses. Better measures are:

• The share of payment-detail changes independently verified.
• The share of commercial clients using dual control.
• The median time from a customer’s fraud report to a recall request.

Several further measures help a board see whether the program is working. The share of fraudulent payments recovered in whole or part shows whether the recovery path functions. The false-positive rate on payment holds shows whether friction is calibrated. The number of commercial clients onboarded with controls switched on from the start shows whether the institution has made safety the default rather than an option.

The old framing produces predictable errors. Teams buy another email filter and call the problem solved. The callback rule lives in a policy document nobody audits. Friction is switched off because a few clients complained. And the fraud hotline runs as a business-hours service, when fraud does not keep office hours.

Where security still leads

Moving ownership does not remove the security team from the picture. Security owns several things only it can do. It detects compromised mailboxes through unusual sign-ins and suspicious forwarding rules. It enforces multi-factor authentication on staff email, which makes the mailbox takeover step harder. It publishes the institution’s own email authentication records, so criminals cannot easily impersonate the bank to its clients. And it investigates when the institution’s own staff are targeted.

The right arrangement is a single accountable executive for BEC losses, usually in payments or fraud operations, with security as a named contributor. That executive reports the loss and recovery measures to the board alongside other fraud metrics, where they belong.

Where the payment controls need an owner

1. Who, by name, owns the rule that every change to payment details is verified through an independent channel, and when was it last audited?
2. What share of our commercial clients have dual approval, locked templates and change alerts turned on in our treasury platform? Who is responsible for raising that number?
3. Do we watch for newly opened accounts receiving large business payments that do not fit their stated purpose?
4. If a client calls at 7 p.m. on a Friday to report wire fraud, who answers, and how quickly does a recall request go out?
5. Are we measuring fraud losses and recovery speed, or only blocked emails?

Listen for answers that name a person, a number and a time. The same goes for the follow-ups. Ask what share of last month’s payment-detail changes were confirmed by callback and whether a second person approves every change to the vendor master file. Ask how often payment holds turn out to be false alarms. “Security handles that” or “the client is responsible” are signs that the control point has no owner, which is exactly where BEC losses happen. The good news is that every gap these questions reveal can be closed with process, configuration and clear authority, most of it using tools and people the institution already has.

With hindsight

The losses kept growing after the 2020 report. Later IC3 reports showed reported losses rising year after year; the 2024 report put total reported losses at about $16.6 billion, with BEC still among the costliest categories at nearly $2.8 billion. A crime that looked large in 2021 became larger still.

BEC losses themselves grew and then held at a high level. The IC3’s reports put them at about $2.4 billion for 2021, and in the range of roughly $2.7 billion to $2.9 billion a year from 2022 through 2024. Total reported losses grew much faster, driven largely by investment fraud. BEC did not fade. It became one large problem among several.

The tools changed. By 2024, criminals were using voice cloning and deepfake video, artificial intelligence that can convincingly imitate a real person’s voice or face, to impersonate executives. In a widely reported Hong Kong case, an employee was persuaded on a video call to transfer about $25 million. The company was later identified as the engineering firm Arup. Its mechanics matched the 2021 pattern: an employee acted on instructions delivered through a channel the criminal had arranged. The old advice to “pick up the phone and check” now has to be sharper: check using contact details you already had, through a channel the requester did not choose.

Regulators followed the change in tools. In November 2024, FinCEN issued an alert to financial institutions on fraud schemes using deepfake media, describing red flags and asking for them to be referenced in suspicious activity reports. Earlier, in August 2021, the federal banking agencies’ examination council had replaced its long-standing guidance on authentication with new guidance. It asked institutions to assess risk across all users and access points, including business customers, and to look beyond passwords.

The control points did not change. Independent verification of payment changes and fast recovery paths still prevent most losses. That is the encouraging part of this story. The technology of deception keeps improving, but the defenses that matter most are procedural and organizational, and they do not need to be reinvented every time criminals get a new tool.

The rails got faster. FedNow launched in July 2023, joining the private RTP network in offering instant, final payments. Same Day ACH limits had already risen. Each step made the recovery window shorter and put more weight on controls before release. The Fedwire Funds Service also moved to the ISO 20022 message standard in July 2025, which carries richer, more structured information about payers and payees. Better data does not stop fraud by itself, but it gives screening tools more to work with.

Payment rules moved too. Nacha, the organization that sets the rules for the ACH network, introduced risk-based fraud monitoring requirements for ACH that took effect in two phases in March and June 2026. They push receiving institutions to watch for the mule accounts that BEC relies on. That shifts some attention to the receiving side of the payment, the point where an unusual deposit into a new account can reveal a fraud in progress. Organizations should confirm with their legal advisers and payment providers how those obligations apply to them.

Abroad, the United Kingdom took the liability route, with mandatory reimbursement for many authorized push payment fraud victims from October 2024. The United States did not follow with a comparable rule for business payments. American institutions and their commercial clients still carry the incentive to prevent the loss rather than the expectation of being repaid.

One expectation did not hold up: that wider adoption of email authentication would bring BEC losses down. Authentication did spread, helped in 2024 by major mailbox providers’ new requirements for bulk senders. BEC losses stayed high anyway, because the costliest cases came from genuine mailboxes that had been taken over, where authentication checks pass.

What has lasted is a sense of where to look. BEC is not mainly an email problem. It is a payment-process problem that arrives by email. The institutions that treat it that way, with one owner, audited verification, configured client controls and a recovery line that answers at any hour, are the ones turning would-be losses into near misses.