What does BEC stand for?
BEC stands for Business Email Compromise. A fraud where an attacker impersonates or takes over a business email account, typically an executive or supplier, to redirect payments or obtain sensitive data.
BEC is fraud carried out through email that appears to come from someone the victim trusts: a senior manager, a supplier, a lawyer. The message asks for a payment, a change of bank details, gift cards or staff records full of PII. The sender's address is spoofed, looks nearly identical to the real one, or is a real mailbox the criminal has taken over. Many BEC messages contain no link and no attachment, which is why filters that look for malware miss them. The defence is procedural: confirm payment requests through a second channel.
BEC in practice: an example
An accounts clerk receives a message that appears to come from a regular supplier, saying its bank has changed and giving new account details for the next invoice. The clerk phones the supplier on the number already on file, not the one in the message. The supplier knows nothing about a change, and the payment is not sent.
What BEC is confused with
BEC vs phishing: what is the difference?
Ordinary phishing is sent in bulk and tries to harvest passwords or deliver malware. BEC is targeted, impersonates a specific trusted person and asks directly for money or data, often with no link at all.
BEC vs whaling: what is the difference?
Whaling targets a senior executive as the victim. In BEC the executive is more often the person being impersonated, and the victim is the employee who can make the payment.
Which exams cover BEC?
BEC is on the official CompTIA acronym list for three of the four exams covered here.
- Security+ SY0-801: 5.6 (Security Program Management and Oversight).
- CySA+ CS0-004: 1.2 (Security Operations).
- A+ 220-1201 and 220-1202: 220-1202 2.0 (Security).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. The finance team receives an urgent email that appears to come from the chief executive, asking for a wire transfer to a new account before the end of the day. What should happen first?
- Send the transfer because it is urgent
- Verify the request by calling the executive on a known number
- Reply to the email asking if it is real
- Forward the message to all staff
Show the answer
B. Verify the request by calling the executive on a known number. Verification through a separate, already known channel defeats the impersonation. Replying to the message only reaches the criminal.
2. Why do many BEC messages pass through email security filters?
- They are always encrypted
- They often contain no malicious link or attachment to detect
- Filters do not scan messages from executives
- They are sent only on weekends
Show the answer
B. They often contain no malicious link or attachment to detect. The message is plain text asking a person to act. With nothing technical to scan, detection depends on sender checks and on the recipient's procedure.
Sources: FBI Internet Crime Complaint Center: Business Email Compromise (public service announcement, September 2024); Microsoft Learn: Anti-phishing protection in Microsoft 365. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.