Business Email Compromise Detection

The FBI describes BEC as a scheme where criminals impersonate a trusted source or compromise an email account to request money or sensitive information. Common scenarios include fake supplier payment changes, executive requests and fraudulent real-estate wires. Attackers may spoof an address, use a lookalike domain, steal credentials or enter an existing invoice thread. Because the message can resemble normal business communication, the payment workflow is part of detection—not only the email body. An AI classifier may flag unusual sender-recipient relationships, language or payment patterns, but these signals are context-dependent. A new supplier, legitimate urgent payment or staff role change can also look unusual. An alert should lead to a verification step using a trusted, independently sourced contact method. Do not call a phone number or click a link supplied in the suspicious message. Require dual approval or another control for account changes and high-value transfers where appropriate. For modeling, define the event carefully: reported scam, compromised mailbox, unauthorized transfer or another label. These are related but not identical. Historical incident records can miss undetected attempts and reflect existing reporting practices. Evaluate alerts with confirmed outcomes, reviewer feedback, false alarms and time-to-response. Preserve evidence, protect employee and customer data, and document how a human resolves an alert. If funds were transferred, contact the financial institution promptly and use official FBI IC3 reporting instructions. An automated warning alone does not establish criminal intent.