What is business email compromise and how does it affect B2B payments?

Business email compromise (BEC) is a fraud scheme where a criminal impersonates a trusted contact, such as an executive, vendor, or attorney, over email to convince someone at a company to send a payment, change vendor bank details, or share sensitive financial information. It doesn’t usually rely on malware or a suspicious link. It relies on trust, timing, and a legitimate-looking request that lands in the right inbox at the right moment.

That makes BEC a finance and accounts payable (AP) problem as much as a cybersecurity one. It caused $3.04 billion in reported losses in the U.S. in 2025, the second-highest loss total of any cybercrime category tracked by the FBI’s Internet Crime Complaint Center (IC3), trailing only investment fraud. And according to the Association for Financial Professionals’ (AFP) 2026 Payments Fraud and Control Survey, 74% of organizations were affected by BEC in 2025, up sharply from 63% in each of the two prior years.

For CFOs, treasurers, and AP leaders, those numbers point to the same conclusion: BEC is aimed directly at the wires, ACH transfers, and checks your team processes every day.

What is business email compromise?

Business email compromise is a targeted fraud tactic built on impersonation rather than technical intrusion. A fraudster poses as, or gains actual access to, a trusted email account, then uses that access to redirect money or sensitive data.

Three things separate BEC from ordinary phishing:

• It’s targeted. Attackers research a company, its vendors, and its org chart before sending a single email.
• It’s often malware-free. Many BEC attacks contain no link or attachment to trigger a spam filter, just a well-written request.
• It’s aimed at money movement. The end goal is often a wire, an ACH transfer, a check, or a change to where future payments land.

Two entry points show up most often:

• Domain spoofing: the attacker registers a lookalike domain (a swapped letter, an extra hyphen) and sends email that looks like it’s from a real vendor or executive.
• Account takeover: the attacker actually compromises a real mailbox, often through a prior phishing attack, then reads real invoice threads before inserting a fraudulent instruction mid-conversation.

Generative AI has made both approaches more convincing. The FBI’s 2025 IC3 Annual Report included a dedicated section on AI-enabled fraud for the first time, logging more than 22,000 complaints with an AI-related component and roughly $893 million in associated losses. AFP’s research has flagged the same trend: fraudsters are using generative AI to write cleaner, more convincing BEC emails than in years past.

How does business email compromise work in B2B payments?

BEC attacks aimed at B2B payments tend to follow a few scripts. The details vary, but the target is almost always the same: a legitimate payment that gets redirected, or a fake one that gets approved.

How does BEC affect B2B payments?

BEC losses concentrate in the payment types that move fastest and settle hardest to reverse. According to an analysis of FBI IC3 data, 86% of BEC losses in 2025 moved through wire transfer or ACH, not checks, because both settle quickly and leave a narrow window for recovery once funds clear.

A few points worth calling out for finance leaders:

• The average BEC incident is expensive. IC3 logged roughly 24,768 BEC complaints in 2025, which works out to an average loss near $123,000 per incident, well above the average for high-volume scams like generic phishing.
• Wire transfers carry outsized BEC risk. AFP’s 2025 survey found wire transfers had reclaimed the top spot as the payment type most frequently targeted by BEC, ahead of ACH credits.
• Bigger companies aren’t safer. AFP’s 2026 survey found 66% of organizations with revenue over $1 billion reported fraud losses, compared with 48% of organizations under that threshold, likely a reflection of higher transaction volume and more complex vendor relationships.

It’s worth separating BEC-specific data from payments fraud generally. Checks remain the payment method most frequently affected by fraud overall (58% of organizations in 2025), ahead of ACH debits (30%) and wire transfers (25%), per AFP. But BEC specifically skews toward wire and ACH, since those are the payment rails that give a fraudster a fast, largely irreversible payout.

Why AP and finance teams are especially exposed

AP workflows are attractive targets because they’re built for speed and volume, not scrutiny of every single request. A few structural factors compound the risk:

• High transaction volume makes one fraudulent invoice or bank-detail change easy to miss among hundreds of legitimate ones.
• Vendor bank-detail changes are routine, which gives fraudulent ones cover to blend in.
• Remote and hybrid work shifted more verification onto email and chat, away from in-person or phone confirmation.
• Delegated approval authority means multiple people can move money, which multiplies the number of employees a fraudster can try to impersonate or target.

Treasury tends to be the first line of defense once an attack is underway. AFP’s 2026 survey found treasury is the department most likely to catch attempted fraud (83% of the time) and actual fraud (55% of the time). That’s a useful backstop, but it means most BEC defenses today catch the attack in progress rather than preventing the attempt in the first place.

How can businesses protect B2B payments from BEC?

No single control eliminates BEC risk. A layered approach, combining verified processes, technology controls, and ongoing training, gives a fraudulent request more chances to get caught before money moves.

Process controls:

• Callback verification. Before honoring any change to vendor banking details, call a phone number you already have on file, never one provided in the email requesting the change.
• Dual approval and segregation of duties for wires and any update to the vendor master file.
• A waiting period for large or first-time payments to a new account.
• Regular training on BEC red flags: urgency, requests to bypass normal process, or a sudden change in tone or channel from a known contact.

Technology controls:

• Multi-factor authentication (MFA) on email and financial systems, since account takeover often starts with a single compromised password.
• Domain monitoring to flag lookalike domains before they’re used in an attack.
• Transaction-level payment controls, such as virtual cards, which can limit what a compromised or spoofed instruction is actually able to do.

That last point matters for AP specifically. Virtual cards generate single-use numbers tied to a specific vendor, amount, and expiration window. A virtual card doesn’t stop a BEC email from landing in an inbox, but it does change what happens if AP acts on a fraudulent request: there’s no bank account for a fraudster to simply redirect funds into the way there is with a wire or ACH payment. WEX has supported virtual payments for more than 20 years and powered north of $237 billion in payments in 2025, so this is a control finance teams don’t have to build from scratch to adopt.

Also worth noting: The WEX 2026 Business Payments Report found that 34% of surveyed organizations use AI-based fraud detection today. It’s the least common of the four prevention measures the survey asked about, behind MFA (85%), encryption (69%), and manual review (62%).

Frequently asked questions

Is business email compromise the same as phishing?

Not exactly. Phishing is typically a high-volume, less-targeted attack meant to harvest credentials or install malware across many potential victims. BEC is narrower and more deliberate: it targets a specific person or process, usually skips malware entirely, and aims directly at a payment or a change to payment instructions. That’s part of why BEC’s average loss per incident runs higher than typical phishing, even though phishing generates many more complaints overall.

Which payment method is most vulnerable to BEC?

Wire transfers have recently topped AFP’s survey as the payment type most frequently targeted by BEC schemes, with ACH close behind. FBI data backs this up: 86% of BEC losses in 2025 moved through wire or ACH, since both settle quickly and are difficult to reverse once funds clear. Checks are more often tied to other types of payments fraud, like check washing or mail theft, rather than BEC specifically.

Can a business recover money lost to a BEC scam?

Sometimes, but it depends heavily on speed. The FBI’s Recovery Asset Team can help freeze funds when a bank is notified quickly, and it has helped recover hundreds of millions of dollars in recent years. 

How is BEC different from invoice fraud?

Invoice fraud describes the outcome (a fake or altered invoice gets paid), while BEC describes one common way that outcome gets set up (through a compromised or spoofed email). The two overlap often, but invoice fraud can also happen without any email compromise at all, for example through a mail intercept or an insider changing payment details directly.

The bottom line

BEC keeps growing because it targets a process businesses can’t avoid: paying vendors, employees, and partners. Treating it as purely an IT issue misses the point. It’s an AP and treasury exposure that happens to travel through an inbox.

Layering verified processes with payment-level controls, like callback verification, dual approval, and transaction-specific virtual cards, doesn’t make BEC impossible. It does make a fraudulent request far more likely to get caught before it turns into a wire that’s already gone.

If your AP team still verifies vendor bank-detail changes by replying to the same email thread that requested them, that’s the exact gap BEC is built to exploit. Building payment-level controls, like virtual cards tied to specific vendors and amounts, adds a check that email alone can’t provide.

For more insights and updates on corporate payments, check out:

• 2027 business payment trends
• How to create an anti-fraud culture
• How to prevent B2B payment errors before year-end

Learn more about how WEX payment solutions can be tailored to your business, so you can accelerate and streamline operations while creating lasting growth and success for your organization.

The information in this blog post is for educational purposes only. It is not legal or tax advice. For legal or tax advice, you should consult your own legal counsel, tax, and investment advisers.

Copyright ©2026 WEX Inc. All rights reserved. The information in this document is subject to change without notice.