What is business email compromise (BEC)? Payment fraud by email, in filings and enforcement

Business email compromise (BEC) is a fraud in which criminals use a compromised or impersonated business email account, through social engineering or computer intrusion, to get employees to send money or sensitive data to accounts they control. Requests often pose as an executive or a vendor. It attacks the payment process rather than the systems themselves.

The scale on the record

The FBI's Internet Crime Complaint Center (IC3) defines BEC as a scam that targets businesses and individuals who perform legitimate transfer-of-funds requests. In a public service announcement dated 11 September 2024 it counted 305,033 domestic and international incidents and $55,499,915,582 in exposed losses from October 2013 to December 2023, reported in all 50 states and 186 countries.

How it shows up in filings

A BEC loss can reach Form 8-K with no system breached. Orion S.A. reported on 12 August 2024, under Item 8.01, that an employee had been the target of a criminal scheme that produced fraudulently induced wire transfers to accounts controlled by unknown third parties. It expected a one-time pre-tax charge of about $60 million and said it did not believe the incident involved unauthorized access to its data or systems. The filing does not use the term; The Record reported it as business email compromise on 13 August 2024.

How regulators treat it

The Securities and Exchange Commission (SEC) has framed BEC as an internal accounting controls problem. On 16 October 2018 it issued an investigative report on nine public companies that lost money to BEC schemes. Each lost at least $1 million, and together they wired nearly $100 million, most of it unrecoverable. No charges were brought, but the SEC said issuers must calibrate their controls to the risk environment.

What it is not

BEC is not ransomware: nothing is encrypted and the loss is a payment, not an outage. It is also more than phishing; the defining step is a fraudulent request to move funds or data. A 2018 CISA alert described the scheme as running on social engineering or computer intrusion, so payment verification matters as much as mailbox security.

Where it appears on cisonews.net

Public companies report losses like Orion's on Form 8-K, which the incident log and the Item 1.05 filings tracker follow. The controls angle is covered under SEC enforcement action.