Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Phishing is the broad tactic of impersonating a trusted source to steal information or access. Business email compromise (BEC) is a payment-fraud pattern in which an attacker spoofs or takes over an account to redirect a legitimate transfer. An advance-fee scam demands money first for a promised prize, grant, loan, job, inheritance or other benefit that never arrives or is worth far less.
These labels can overlap. A phishing message may steal credentials that later enable BEC, and an advance-fee demand may arrive through a phishing email. Classify the incident by the immediate objective and the action the message wants you to take.
The three scams at a glance
| Scam | Primary objective | Sender or account | Typical request | Main harm |
|---|---|---|---|---|
| Phishing | Steal credentials, personal data or access; sometimes deliver malware | A spoofed identity, look-alike site or occasionally a compromised account | Click a link, open an attachment, reply with information or enter a password | Account takeover, malware, identity theft or data exposure |
| Business email compromise (BEC/EAC) | Cause an unauthorized business or personal transfer | A spoofed or genuinely compromised mailbox belonging to an executive, supplier, employee or customer | Change bank details, pay an invoice, wire funds, buy gift cards or send payroll information | Direct financial loss and disruption of payment processes |
| Advance-fee fraud | Collect an upfront payment for a promised larger benefit | Usually an invented or impersonated person, company or agency | Pay a tax, deposit, processing charge, insurance fee or other amount before receiving value | Immediate loss, followed by possible identity or account theft |
The requested action is usually more informative than the sender’s claimed identity. A “verify your password” link points to phishing; a supplier’s new bank account for an existing invoice points to BEC; a demand for a fee before releasing a grant points to advance-fee fraud.
What phishing is and how it works
The FBI describes phishing as a message that appears to come from a legitimate business and asks you to update or verify personal information, often through a look-alike website. The fake site can capture passwords, card numbers or banking PINs. Phishing schemes often use spoofing techniques to lure you into taking the bait.
#1 Best Overall
Spoofing is the disguise
The FBI defines spoofing as disguising an email address, sender name, phone number or website URL—often by changing one letter, symbol or number—so the target believes the interaction is genuine. The visible display name may say “Accounts Payable,” while the actual address uses an unrelated domain or a subtle misspelling. A familiar logo and copied signature do not authenticate a message.
The usual phishing sequence
- Impersonation: The attacker copies a bank, cloud service, employer, delivery company or colleague.
- Urgency: The message claims an account will be closed, a payment is overdue or a security check is required.
- Capture: A link opens a fake sign-in page, an attachment runs code or a reply collects information.
- Use: Stolen credentials may be sold, used to access mail and cloud files, or used to launch a later fraud.
Phishing variants
Phishing is an umbrella term. Vishing uses voice calls, smishing uses text messages and pharming redirects users to a fraudulent site even when they enter a legitimate-looking address. Spearphishing is tailored to a named person or organization; mass phishing uses the same lure against many recipients.
Example
An email says, “Your business banking password expires today. Verify it here.” The link opens a page that copies the bank’s branding and asks for the username, password and one-time code. The immediate goal is access, not a particular invoice payment, so this is phishing. If the attacker then enters the mailbox and sends a fraudulent wire request, the later event is BEC as well.
Rank #2
What business email compromise is
The FBI’s Internet Crime Complaint Center (IC3) defines BEC/EAC as “a sophisticated scam that targets both businesses and individuals who perform legitimate transfer-of-funds requests.” It is frequently carried out by compromising legitimate business or personal email accounts through social engineering or computer intrusion and then conducting unauthorized transfers.
BEC does not require a hacked mailbox
An attacker can register a look-alike domain, forge a sender address or use a legitimate account that has been taken over. A fraudulent message that appears to come from a supplier and changes the bank account for an invoice is BEC even when the supplier’s mailbox was never hacked. The decisive feature is the payment manipulation.
Common BEC scenarios
- Invoice diversion: A criminal impersonates a supplier and sends replacement bank details for an invoice already expected by accounts payable.
- Executive impersonation: A message purports to be from a chief executive or manager and asks an employee to wire money immediately or purchase gift cards.
- Payroll redirection: An attacker requests that an employee’s direct-deposit account be changed.
- Real-estate or closing fraud: A criminal inserts new wiring instructions into a property or legal transaction.
- Customer or attorney impersonation: The attacker exploits an existing business relationship to make a transfer appear routine.
Why BEC is more than ordinary phishing
Phishing often ends when credentials or data are captured. BEC exploits an organization’s payment workflow: approval authority, vendor records, invoice timing and trust between employees. The email may contain no malicious link at all. It can be a short, plausible request sent from a real compromised mailbox, which is why spam filters and spelling checks alone cannot stop it.
What an advance-fee scam is
The FBI IC3 2025 Annual Report defines advanced-fee fraud as: “An individual pays money to someone in anticipation of receiving something of greater value in return but instead receives significantly less than expected or nothing.” The payment sequence distinguishes this scam: money is demanded first, value is promised later.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsTypical advance-fee stories
- A grant or inheritance is supposedly approved, but a tax or release fee must be paid first.
- A lottery or prize winner must pay “processing,” insurance or customs charges before delivery.
- A job applicant is asked for a deposit, equipment fee or background-check payment before hiring.
- A borrower is promised a loan after paying an application or guarantee fee.
- A person seeking a relationship, investment or immigration help is asked to cover an urgent expense before a promised benefit.
Legitimate organizations may charge fees for real services, but an advance-fee warning sign is a guaranteed or unusually large benefit conditioned on an urgent payment to an unfamiliar person or account. Once paid, the victim may be told that another fee is required. The original loss can be followed by requests for identity documents or remote access.
Example
A message claims that you have inherited $250,000 but must send $1,200 for a “tax clearance certificate.” The promised inheritance is the lure and the upfront transfer is the objective. If the message also links to a fake government login page that steals your password, it is both advance-fee fraud and phishing.
Rank #4
How the categories overlap
The categories describe different dimensions of one campaign. Phishing describes the delivery and social-engineering method; BEC describes a payment-focused business-fraud outcome; advance-fee describes a pay-first economic model.
| Situation | Best classification | Reason |
|---|---|---|
| A fake cloud-service sign-in page asks for your password and one-time code. | Phishing | The immediate objective is credential theft. |
| A look-alike supplier domain requests that an invoice be paid to a new account. | BEC | The request redirects a legitimate transfer, regardless of whether the real mailbox was compromised. |
| A “grant office” demands a processing fee before releasing funds. | Advance-fee fraud | Payment is required before the promised benefit. |
| A phishing email steals an employee’s credentials, then the attacker sends a wire request from the mailbox. | Phishing followed by BEC | Credential theft enabled a later payment-compromise stage. |
| A fake lender sends a link to collect identity details and then demands an upfront insurance fee. | Phishing and advance-fee fraud | The campaign combines data theft with a pay-first demand. |
When reporting, describe every stage rather than forcing the incident into one label. State what the message asked for, whether credentials were entered, whether an account was accessed and whether money moved.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →How to identify the scam you are seeing
- Look at the requested action. A link, attachment or request for credentials points to phishing. Bank-detail changes, wires, gift cards or payroll changes point to BEC. A fee before a promised benefit points to advance-fee fraud.
- Check whether the payment is part of a real workflow. An unexpected change to an existing invoice or transaction is a BEC warning. A payment for a prize, grant or loan that you never independently applied for is an advance-fee warning.
- Verify outside the message. Use a known telephone number, a bookmarked official site or a second communication channel. Do not use contact details in the suspicious message.
- Inspect the account and domain. Compare the complete address, not just the display name. A near-match, newly registered-looking domain or reply-to address that differs from the sender is suspicious.
- Assess the pressure. Threats of account closure, secrecy, unusual payment methods and demands to bypass normal approval are common across all three categories.
- Record what happened. Note the sender, full headers, links, attachments, requested amount, destination account, dates and any information you entered.
What to do when a message arrives
If you have not clicked or paid
- Stop. Do not click, reply, open attachments, scan a QR code or call a number supplied in the message.
- Report the message through your mail or messaging service, then delete it or preserve it according to your organization’s evidence policy.
- Verify any real request independently. For an invoice or bank-detail change, call a known supplier contact and require a second-person or out-of-band confirmation.
- Tell colleagues or family members who might receive the same campaign, without forwarding active malicious links.
If you entered credentials or opened an attachment
- From a clean, trusted device, change the exposed password and every other account that reused it.
- Enable multifactor authentication (MFA), revoke unfamiliar sessions and review mailbox forwarding rules, recovery addresses and recent sign-ins.
- Tell your IT or security team immediately. They may need to isolate a device, reset tokens, scan for malware and check whether mail or files were accessed.
- Watch for follow-up impersonation. An attacker who knows your conversation history can make the next message more convincing.
If money or gift cards were sent
- Contact the bank, payment provider or gift-card issuer immediately and request a recall, reversal or freeze. IC3 advises that “time is of the essence” after a fraudulent transfer.
- Provide the transaction number, destination account, amount, time, recipient details and copies of the messages.
- Report the incident to IC3 and the Federal Trade Commission (FTC) as appropriate. Follow any instructions from your bank and local law-enforcement agency.
- Preserve the original message, complete headers, attachments, chat logs, invoices, payment confirmations and a timeline. Do not negotiate with the criminal or pay a “recovery” service that promises to get the money back for another upfront fee.
Controls that reduce phishing and BEC risk
For individuals
- Use a unique password for every important account and store passwords in a reputable password manager.
- Turn on MFA, preferably with a phishing-resistant security key or passkey where available.
- Open financial or government sites from a saved bookmark rather than an unexpected link.
- Never move money to “protect” it, buy gift cards to resolve an account problem or use a Bitcoin ATM because a caller demands it. The FTC specifically warns against these instructions.
- Keep operating systems, browsers and security software updated, and maintain offline or otherwise protected backups of important files.
For businesses
- Require two-person approval and an out-of-band callback for new beneficiaries, bank-detail changes, urgent wires, payroll changes and gift-card purchases.
- Train employees to inspect full sender addresses and to report suspicious messages without fear of blame.
- Use MFA, unique passwords, conditional access and least-privilege permissions. Review sign-in logs, mailbox rules and forwarding settings for high-value accounts.
- Configure email-authentication controls such as SPF and DKIM, and use the organization’s available anti-spoofing and domain-protection policies.
- Separate invoice entry from payment approval, reconcile vendor details against previously verified records and slow down requests that demand secrecy or bypass normal process.
- Maintain an incident plan with bank contacts, recall procedures, reporting contacts and evidence-preservation steps. Test it before a real payment incident.
What the official numbers show
| Measure | Figure and scope |
|---|---|
| BEC incidents | 305,033 domestic and international incidents reported to FBI IC3, covering October 2013 through December 2023. |
| Exposed BEC losses | $55,499,915,582 in FBI IC3 statistics covering October 2013 through December 2023. |
| Year-over-year BEC change | Identified global exposed BEC losses increased 9% from December 2022 to December 2023, according to the FBI IC3 2024 public service announcement. |
| Business impersonation | More than 330,000 reports in 2023, according to the FTC’s 2024 Data Spotlight. |
| Government impersonation | Nearly 160,000 reports in 2023, according to the FTC’s 2024 Data Spotlight. |
| Impersonation losses | More than $1.1 billion in reported losses in 2023, according to the FTC’s 2024 Data Spotlight. |
| Most common contact method | Email was the top method scammers used to contact people in 2024, according to an FTC consumer alert published in 2025. |
These figures come from reported incidents and exposed losses; they are not a measure of every scam. Many victims do not report, and loss totals can change as investigations identify additional transactions.
Best Value
- This fun, nerdy, geeky, retro Cybersecurity Awareness Month design is perfect to wear this October. Great for cyber security professionals and experts who keep people safe on the internet, safe online, and safe online.
- Wear this for October National Cyber Security Awareness Month this October, raise awareness about cyber security on smartphones, laptops at your school, in the classroom or on your college or university campus. Be safe online and make sure others are too!
- Lightweight, Classic fit, Double-needle sleeve and bottom hem
Questions people commonly ask
Is BEC just phishing?
No. Phishing is a method for luring a target into clicking, opening or disclosing information. BEC is a payment-fraud pattern. Phishing can be the entry point to BEC, but a BEC message can also be a plain, convincing payment request with no link or attachment.
Can a spoofed email count as BEC if no account was hacked?
Yes. A spoofed supplier or executive identity can redirect a legitimate payment even when the genuine mailbox remains secure. Account compromise is common but not required.
Is every request for an upfront fee an advance-fee scam?
No. The warning pattern is an unsolicited or deceptive promise of disproportionate value, pressure to pay before delivery and an unverifiable recipient or purpose. Verify the organization and service independently before paying any advance charge.
What if I cannot tell which category applies?
Take the same first steps: stop interacting, verify through a known channel, secure exposed accounts, contact the financial institution if money moved and preserve evidence. In a report, describe the exact request and sequence instead of relying on a label.
Bottom line
Use the immediate objective to separate the scams: information or access theft is phishing, unauthorized transfer of a legitimate payment is BEC, and payment before a promised benefit is advance-fee fraud. Because one campaign can contain all three, document each stage and respond fastest to any credential exposure or financial transfer.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
