Glossary

Business email compromise (BEC)

Fraud in which a criminal impersonates an executive, vendor or client by email to trick an employee into sending money or changing payment details.

Also called: BEC, email account compromise, CEO fraud, vendor impersonation fraud, payment diversion fraud

Business email compromise is a payment fraud carried out through email. A criminal spoofs or takes over an account and poses as an executive, a vendor, a customer or a closing attorney. Typical versions are a "new bank details" notice from a real supplier, an urgent wire request from the supposed CEO, and a swapped wire instruction at a real estate closing. The FBI's Internet Crime Complaint Center counted about $3.05 billion in reported BEC losses in its 2025 annual report.

Coverage depends on wording. The computer fraud and funds transfer fraud grants in a commercial crime policy generally respond to unauthorized access or instructions. An employee who knowingly sends a wire after a convincing email has authorized it, and insurers and courts often find no coverage. That gap is why crime and cyber policies add social engineering fraud coverage, usually with a sublimit well below the main limit and a condition that you verified the request.

Verification is the control insurers ask about: a callback to a known number before any change to payment instructions, dual approval for wires, and multi-factor authentication on email. If money has moved, call the bank immediately and file with the FBI, because recalls work only within hours. Check whether your crime and cyber policies overlap or leave a gap. The guide on business email compromise and funds transfer fraud coverage compares the policy types.

Last reviewed October 10, 2026

In the index now

Related terms

Social engineering fraud Fraud that tricks an employee into voluntarily sending money or data by impersonating a vendor, executive or client, rather than breaking into systems. Funds transfer fraud Crime coverage for money taken from your bank account by a fraudulent instruction to your bank that you did not send or approve. Computer fraud A crime-policy coverage for money, securities or property lost when someone uses a computer to fraudulently move it out of your premises or accounts. Multi-factor authentication (MFA) A login check that requires two or more kinds of proof, such as a password plus a code or device, and a control cyber insurers now expect. Breach coach A privacy attorney, usually from the cyber insurer's panel, who directs the first days of a data breach or ransomware response.

Related guides

Business email compromise and funds transfer fraud coverage A hijacked mailbox can cost you stolen payments, a data breach and a customer's misdirected invoice. Which parts a cyber policy pays and where the gaps are. Cyber insurance: what it covers for a business What a cyber policy pays for after a breach, ransomware attack or email fraud, how limits and retentions work, and what the policy leaves out. Deepfakes and AI-driven fraud: what cyber and crime policies cover How AI voice and video impersonation is used to move money, which policy answers a deepfake loss (crime, cyber or neither), and the controls insurers expect. Does a small business need cyber insurance? No law requires it, but most small businesses that hold customer data, take payments or wire money should carry it. How to judge your exposure and what to buy. Social engineering fraud: cyber policy or crime policy? Where fake-vendor and fake-CEO payment scams are covered: crime policy impersonation cover, cyber policy sublimits, verification conditions and overlap.

Related tools

Cyber insurance readiness checklist Rate 25 security controls yes, partly or no to see your readiness score, your gaps and which controls cyber insurance applications commonly ask about.