What is AI Business Email Compromise?
Business email compromise (BEC) has always been one of the most financially damaging forms of cybercrime. Artificial intelligence is making it considerably more difficult for employees to recognize. The spelling mistakes, awkward sentences and generic greetings employees have traditionally been taught to watch for are disappearing. Attackers can now create convincing messages using real information about your employees, executives, vendors and business relationships. In this blog post, we will outline what AI has changed about BEC and how businesses can defend against AI-enhanced BEC.
What is Business Email Compromise?
Business Email Compromise is a targeted form of social engineering in which a cybercriminal impersonates someone the recipient trusts. BEC is already extraordinarily costly and now, AI is giving attackers new ways to make these scams faster, more personalized and much more convincing.
Common impersonations include:
- A CEO or business owner
- A manager or executive
- A vendor or supplier
- An employee
- An accountant or financial institution
- A client or business partner
The objective is usually financial: convincing someone to transfer money, change banking information, redirect payroll or provide sensitive company information.
The FBI’s 2025 Internet Crime Report recorded more than $3 billion in reported BEC losses during 2025 alone, making BEC one of the costliest forms of cyber-enabled fraud. –Internet Crime Complaint Center
What Has AI Changed About BEC?
Cybersecurity awareness training encouraged employees to look for obvious warning signs:
- Poor spelling.
- Unusual grammar.
- Generic greetings.
- Messages that didn’t quite sound like the supposed sender.
Those clues haven’t disappeared completely, but businesses can no longer depend on them. Generative AI allows criminals to produce polished emails in seconds. Attackers can feed an AI system publicly available information, previous communications or information obtained from a compromised mailbox and use it to create a message that closely resembles legitimate business correspondence.
Microsoft’s 2025 Digital Defense Report has since documented the broader trend, reporting that threat actors are using AI to scale phishing and other malicious activity. Microsoft also describes BEC as an increasingly professionalized, service-based cybercrime ecosystem in which stolen credentials and compromised inboxes can be sold to BEC operators. –Microsoft
The result is an important shift: An email can look completely legitimate and still be fraudulent.
Public Information Gives Attackers the Context
AI makes information gathering significantly more useful to an attacker. Consider how much information about a typical business is publicly available:
- LinkedIn identifies executives, accounting employees and department managers.
- A company website identifies leadership and important partners.
- Social media may announce that the CEO is attending a conference.
- A press release could identify a new customer or supplier.
- Job postings reveal which technologies the company uses.
An attacker can combine these details to construct a believable scenario.
Instead of sending:
“I need you to send an urgent wire transfer.”
An attacker can create something closer to:
“Hi Sarah — I’m still at the conference in Boston. We need to get the final payment over to ABC Manufacturing before 4:00 today so they can release the equipment. Please process it and send me confirmation. I’ll fill you in when I’m back tomorrow.”
Sarah is a real employee. The executive really is travelling. ABC Manufacturing really is a supplier. And the writing sounds exactly like something the executive might send.
That context is what makes modern BEC so dangerous.
Some BEC Emails Have Nothing for Security Software to Detect
There is another challenge for businesses and their IT providers.
A sophisticated BEC email may contain no malware, malicious attachment or suspicious link at all. It is simply text asking an employee to take an action. That means even strong email security technology cannot be the only line of defence. Attackers may also use lookalike domains or manipulate display names so an email appears to come from someone familiar. In more advanced attacks, criminals may compromise an actual Microsoft 365 or Google Workspace account. At that point, the email really is coming from a legitimate mailbox.
That turns BEC from simply an email-security problem into an identity-security problem as well.
The Warning Signs Have Changed
Employees still need cybersecurity awareness training, but that training needs to evolve. Instead of asking only: “Does this email look suspicious?”Employees should increasingly ask: “Is what this email is asking me to do unusual?”
Organizations should pay particular attention when:
- An email requests an urgent transfer of money.
- A supplier suddenly provides new banking information.
- Someone asks for payroll information to be changed.
- An executive requests gift cards or an unusual purchase.
- A financial request bypasses the company’s normal process.
- The sender discourages the recipient from speaking with anyone else.
- A request arrives unexpectedly or creates unusual urgency.
- The display name is correct but the underlying email address is slightly different.
The message itself may be flawless. The request is often where the warning signs now appear.
Managed Security Services: How Businesses Can Defend Against AI-Enhanced BEC
The strongest defence against modern BEC is a combination of technology, identity security, employee education and business process controls.
No single email filter can solve the problem. Here’s what leaders and employees at small and medium-sized businesses need to be aware of:
- Verify Financial Changes Outside of Email
Any request involving a change to banking information should be independently verified. Call the vendor, executive or employee using a phone number your organization already has on file. Do not use the phone number contained in the suspicious email. The same process should apply to significant wire transfers or unexpected payments.
- Require Dual Authorization for Significant Payments
One employee should not necessarily be able to receive an unusual payment request and execute it independently. Organizations should establish thresholds that require a second authorized person to approve significant wire transfers or changes to vendor banking information. This is particularly important for smaller organizations where accounting responsibilities may be concentrated among only a few employees. A simple approval process can stop an attack even when the fraudulent email itself is perfect.
- Strengthen Email Authentication
Businesses should properly configure email authentication technologies including:
- SPF — Sender Policy Framework
- DKIM — DomainKeys Identified Mail
- DMARC — Domain-based Message Authentication, Reporting and Conformance
These controls help prevent attackers from successfully impersonating your organization’s domain. Businesses should also monitor for lookalike domains that criminals could register to impersonate their organization.
- Protect Microsoft 365 and Google Workspace Accounts
Because compromised email accounts can be extremely valuable to BEC attackers, identity security is critical. Businesses should implement strong multifactor authentication and, where practical, move toward phishing-resistant authentication methods. Organizations should also monitor for:
- Suspicious sign-ins
- Unusual mailbox rules
- Unexpected email forwarding
- Changes to authentication methods
- Impossible or unusual geographic logins
- Abnormal access to sensitive mailboxes
Microsoft reported that 28% of breaches it investigated were initiated through phishing or social engineering, reinforcing why identity security and email security need to be addressed together. –Microsoft
- Update Security Awareness Training for the AI Era
Employees shouldn’t be trained only to recognize badly written phishing emails. They need to understand that the next fraudulent message they receive might:
- Mention a real customer.
- Reference an actual project.
- Sound exactly like their manager.
- Arrive while that manager is travelling.
- Contain perfect spelling and grammar.
- Appear to come from someone they trust.
The most important behaviour to teach employees is simple: When a financial or sensitive request is unusual, verify it independently, even when the email looks completely legitimate.
BEC is No Longer Just an Email Problem
Artificial intelligence hasn’t created Business Email Compromise. It has made an already effective form of fraud easier to personalize, automate and scale. That means organizations shouldn’t approach the problem by simply adding another security product. Email security matters. But so do identity protection, authentication, employee training, financial controls and clearly defined business processes.
For small and midsize businesses in particular, those processes can make the difference between an attempted fraud and a significant financial loss. A Managed Service Provider can help assess email security, identity protections, authentication controls and employee security practices and work with your organization to identify where stronger processes are needed. The goal isn’t to teach employees to recognize every AI-generated email. It’s to build security controls and business processes that protect the organization even when they can’t.
