Business email compromise and wire fraud: how finance firms stop the $3 billion scam
BEC losses reported to the FBI reached about $3.05 billion in 2025. How payment-change fraud works, the controls that stop it, and what to do in the first hour.
Business email compromise (BEC) is a fraud in which an attacker uses a compromised or impersonated email account to convince someone to send money to the wrong place. According to the FBI IC3 2025 Internet Crime Report, reported BEC losses were about $3.05 billion in 2025, up from about $2.77 billion in 2024. Finance and accounting firms are frequent targets because they move money and handle payment instructions every day. The good news is that a short list of controls, most of them procedural, makes these attacks far harder to complete.
How large is the problem?
The same IC3 report shows that losses reported across all complaint types in 2025 surpassed $20 billion ($20.877 billion), from 1,008,597 complaints. Investment fraud was the largest loss category, “followed by business email compromises and tech support scams.” BEC losses specifically were $3,046,598,558 in 2025, compared with $2,770,151,146 in 2024.
Those are reported losses. Firms that recover funds quietly, or never report, do not appear in the figures at all.
How a wire-fraud BEC attack typically works
Most BEC attempts against finance firms follow one of three patterns, and many combine them.
- Mailbox takeover. An attacker phishes a password for an employee or a client, signs in, and reads mail quietly for days or weeks. They learn who approves payments, which invoices are due, and how people write. A common sign is a new inbox rule that forwards, hides, or deletes messages containing words like “invoice,” “wire,” or “payment.”
- Lookalike domains. The attacker registers a domain one character off from a client, vendor, or the firm itself, then replies into an existing conversation. A busy reader sees a familiar name and a familiar thread.
- Payment-change requests. The payoff is almost always a request to update bank details: a vendor “switching banks,” a client asking for proceeds to go to a new account, an executive asking for an urgent transfer before a deadline. The request is timed for pressure and often arrives late in the day or before a weekend.
Notice that none of these require malware on your network. The attack runs through normal business email and normal payment processes, which is why technical controls alone are not enough.
Which technical controls reduce the risk?
Phishing-resistant MFA. Mailbox takeover starts with a stolen credential. CISA’s guidance on phishing-resistant MFA calls it “the gold standard” and notes that “the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication.” It also says “any form of MFA is better than no MFA,” so if FIDO keys or passkeys are not yet practical for everyone, enforce MFA now and move high-risk roles (finance, executives, administrators) to phishing-resistant methods first.
Mailbox rule and sign-in monitoring. Alert on new forwarding rules, rules that move or delete payment-related messages, and sign-ins from unusual locations or devices. These are some of the clearest early signs of a takeover in progress.
DMARC, SPF, and DKIM. Publishing a DMARC policy and moving it toward enforcement makes it much harder for someone to send mail that appears to come from your exact domain. It does not stop lookalike domains, so pair it with external-sender tagging and lookalike-domain detection in your email filtering.
Email security filtering. Modern filters can flag impersonation of known contacts, newly registered domains, and messages that ask for payment changes. They reduce volume; they do not replace verification.
Which process controls stop the money from moving?
The most effective defense against BEC is a payment process that does not trust email.
- Out-of-band callback verification. Any change to bank details, or any new payee, is confirmed by phone using a number already on file, never a number from the email requesting the change.
- Dual approval. Wires above a threshold you set require a second approver who reviews the request independently.
- A documented hold period for first-time payments to new account details, so urgency cannot override the process.
- Client communication. Tell clients, in writing and early, that your firm will never change wiring instructions by email. That single sentence makes the fraud harder to run against them.
- Training on the specific scenario. General phishing awareness helps. A short exercise that walks staff through a fake payment-change request helps more.
What the FTC Safeguards Rule means for tax preparers
The FTC Safeguards Rule applies to “financial institutions” under FTC jurisdiction, defined by activity. Tax preparation firms are explicitly listed as examples; other firms should check whether their activities qualify. Covered firms must designate a Qualified Individual to oversee the program, perform a written risk assessment, use MFA, encrypt customer information in transit and at rest (or use approved alternative controls), maintain a written incident response plan, and report in writing to the board or governing body at least annually.
The rule also requires notifying the FTC no later than 30 days after discovering a “notification event” involving unencrypted information of at least 500 consumers. Firms with information on fewer than 5,000 consumers are exempt from certain provisions, but not from the rule as a whole. A mailbox takeover at a tax practice can expose exactly the kind of customer information the rule covers, so confirm your obligations with counsel.
What to do in the first hour after a fraudulent wire
Speed matters more than completeness in the first hour.
- Call your bank immediately and ask it to contact the receiving bank to recall or freeze the transfer. Have the amount, date, and receiving account details ready.
- File a complaint with the FBI’s Internet Crime Complaint Center (IC3) with the transaction details.
- Secure the mailbox. Reset the password, revoke active sessions, remove malicious inbox rules, and confirm MFA is enforced.
- Preserve evidence. Do not delete the fraudulent messages; keep headers and logs for investigators and your insurer.
- Notify your cyber-insurance carrier and, where regulated data may be involved, counsel.
Write these steps into your incident response plan now, with names and phone numbers, so nobody has to look them up under pressure.
How Intelligent Group can help
Intelligent Group works with finance and accounting firms on both sides of this problem. On the technical side, our email security work focuses on filtering, DMARC rollout, and watching for the impersonation attempts, suspicious inbox rules, and unusual sign-ins described above. On the human side, security awareness training gives staff practice recognizing payment-change requests before they act on one. We also help firms move high-risk roles to phishing-resistant MFA, as described in our post on Zero Trust for SMBs.
Frequently asked questions
Does MFA stop business email compromise?
MFA makes mailbox takeover much harder, and phishing-resistant MFA (FIDO/WebAuthn) resists the credential-phishing techniques that defeat weaker methods. It does nothing against lookalike domains, where the attacker never touches your accounts. That is why payment verification procedures are essential alongside MFA.
Is DMARC enough to protect our clients from spoofed emails?
DMARC at enforcement prevents others from sending mail that appears to come from your exact domain. It does not prevent a fraudster from registering a similar domain. Combine it with lookalike-domain monitoring and tell clients you will never change payment instructions by email.
Should we report a BEC attempt that did not succeed?
Yes. A failed attempt can indicate that a mailbox, yours or a client’s, is already compromised. Investigate sign-ins and inbox rules, and consider filing with IC3 so the activity is on record.
Does the FTC Safeguards Rule apply to accounting firms?
The rule applies to financial institutions under FTC jurisdiction, defined by activity. Tax preparation firms are explicitly listed as examples. Other firms should review whether their activities qualify and confirm with counsel.
