iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The “simple hack” behind the billion-dollar threat is usually business email compromise (BEC), also called email account compromise (EAC): criminals impersonate or take over an email identity, then exploit a legitimate payment workflow to redirect money. A familiar sender name—and even a genuine account—does not prove that new payment instructions are authentic.
What makes business email compromise work?
BEC is not necessarily a technical attack on a bank’s payment system. It is fraud aimed at the people and procedures that authorize transfers. The message may appear to come from a vendor, executive, title company, employee, or other trusted contact, and it asks someone to send money or change where a payment goes.
Criminals can use a compromised mailbox, a lookalike email address or website, or information gathered from an account to make a message fit an existing relationship. They may insert themselves into an ongoing invoice conversation, making the request feel routine rather than suspicious.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The FBI describes social-engineering methods that can support these schemes, including phishing, employee impersonation, SIM swapping, and call forwarding. Phishing can be used to steal login credentials; access to an account can expose messages and business details that help an attacker impersonate a real participant.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How does a BEC payment scam unfold?
FinCEN describes a three-stage pattern:
- Gain access or gather information. Criminals use social engineering or computer intrusion to access an email account and collect details about financial institutions, accounts, and contacts.
- Send fraudulent instructions. They use an account they control or a lookalike address to send a payment request or altered instructions.
- Get the transfer approved. The request is made to appear legitimate so an employee or financial institution executes an unauthorized transaction.
The request may be tailored to a real workflow. The FBI gives examples including a regular vendor’s invoice with a changed mailing address, an executive asking an assistant to buy gift cards, and new wire instructions apparently sent by a title company to a homebuyer. Spearphishing or malware may help criminals access credentials or read invoice and billing conversations, so the fraudulent message can arrive at a plausible point in a real transaction.
What does the “billion-dollar threat” figure actually measure?
The headline-scale figure is cumulative, not a one-year loss or a total limited to financial firms. In a 2024 notice, the FBI’s Internet Crime Complaint Center (IC3) reported $55,499,915,582 in global exposed losses from October 2013 through December 2023, across 305,033 domestic and international incidents. IC3 says the figures were reported to IC3 and law enforcement and derived from filings with financial institutions. “Exposed losses” should not be read as confirmed unrecovered losses or as a complete count of all fraud. IC3’s 2024 notice.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
IC3 also reported a 9% increase in identified global exposed losses from December 2022 to December 2023. Separately, a 2025 Federal Reserve Financial Services article attributed to an external source the claim that BEC accounted for 73% of reported cyber incidents in 2024. That is a share of reported incidents, not a dollar-loss figure or an original Federal Reserve measurement; it is not directly comparable to IC3’s cumulative exposed-loss total. Federal Reserve Financial Services, 2025.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow can a company verify changed payment instructions?
Treat a new or changed destination for money as a high-risk request, even when it appears in a familiar email thread. Verify it with the vendor or other party using a phone number or separate channel already on file—not contact details included in the suspicious message. For significant transactions, use a second authorized contact or another independent approval step where appropriate. FinCEN warns that fraudulent wires can be difficult or impossible to cancel once executed, making verification before payment especially important. FinCEN’s advisory to financial institutions.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
- Confirm the change with a known contact method, not a phone number or link in the request.
- Use a second authorized person to review unusual or changed payment instructions.
- Inspect sender addresses and URLs closely; a display name alone is not identity verification.
- Do not treat a message as trustworthy simply because it continues a real invoice or payment conversation.
Which security practices help reduce BEC risk?
No single measure replaces transaction verification. FBI guidance supports several complementary layers, while the cited sources do not quantify how much any individual control reduces risk.
- Protect accounts: use multifactor authentication (MFA) where available, monitor suspicious logins and compromised credentials, and avoid email-based MFA. Refine MFA and account-recovery procedures so a compromised channel is not the only way to regain access.
- Make outside messages visible: the FBI recommends adding an “EXTERNAL EMAIL” banner to messages received from outside an organization.
- Prepare staff and support teams: train employees, help-desk staff, and customer-support personnel with current phishing examples and procedures for independently checking payment changes.
- Keep payment controls separate from email trust: require verification and appropriate approvals for account changes and unusual transfers, even when the email account appears genuine.
The FBI’s organizational recommendations and broader BEC guidance are in its April 11, 2024 advisory. A hardware security key is one possible way to implement phishing-resistant MFA, but compatibility depends on an organization’s identity provider and policy; MFA does not replace payment checks.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What should you do if money has moved or someone clicked a phishing link?
If a payment was sent
- Contact the financial institution immediately and request a recall of the transfer.
- Report the incident to IC3 as soon as possible.
- Preserve the message and transaction details. Relevant information can include dates, amounts, sender and beneficiary details, email addresses, IP addresses, and message timing.
Recovery is uncertain. FinCEN says it has had greater success when law enforcement is contacted within 24 hours; that is not a guarantee that a transfer can be recovered.
If someone clicked a phishing link or entered credentials
Notify the organization’s security or IT team promptly so it can investigate the account and suspicious logins, address compromised credentials, and assess whether payment conversations or instructions were exposed. Preserve the message and relevant timing and account details for the investigation. If a related transfer may have been made, contact the financial institution and request a recall without waiting for the investigation to finish.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
