The FBI's Internet Crime Complaint Center published an advisory in September 2024 titled Business Email Compromise: The $55 Billion Scam. The figure is cumulative reported losses since 2013, across around three hundred and five thousand incidents worldwide.
BEC is not a technical attack. There is usually no malware and frequently no compromised account — a lookalike domain and a plausible email are sufficient. It is a social engineering attack that pairs three elements from Part 10.
Borrowed authority. The request appears to come from the chief executive, the finance director, a known supplier, or a lawyer acting in a transaction.
Manufactured urgency. It must happen today, before a deadline, before a deal closes, while the sender is travelling and hard to reach.
And enforced secrecy. Do not discuss this with anyone, it is confidential until the announcement, I am relying on your discretion.
Those three are laws 9, 8 and 12, and the reason they are combined is that each closes a different verification route. Authority makes the request legitimate, urgency removes the time to check, and secrecy removes the person you would have checked with.
The early signals are specific and worth memorizing rather than reasoning about.
Any change to payment details, ever. This is the single highest-value indicator in the entire category — a supplier notifying you of new bank details is the most common form of the attack.
A request that departs from normal process, justified by circumstances.
Pressure combined with a reason you cannot reach the sender by the usual channel.
And an email address that is correct in the display name and wrong in the domain by one character.
The detection protocol is out-of-band verification, and the phrase carries the whole meaning: verify through a channel the attacker does not control.
That means a phone number you already had, not one in the email. A colleague you walk over to. A messaging channel established previously. Replying to the email is not verification, because the attacker is receiving your reply.
The counter-response, if a payment has gone: contact your bank immediately and request a recall, and report to IC3 within seventy-two hours. The FBI's Recovery Asset Team has a meaningful success rate on domestic transfers reported quickly, and the window is measured in hours.
The organizational counter is a policy rather than training: no change to payment details without a callback to a number held on file, no exceptions for seniority. Chapter 279 explains why the exception for seniority is exactly what is being exploited.
This counters Law 9.