Business Email Compromise (BEC) Fraud — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 26, 2026

Severity: HIGH | View Full Scam Details

Beware Business Email Compromise (BEC) Fraud in India in 2026: How This Rising Cyber Scam Targets Indian Businesses

Business Email Compromise (BEC) fraud is a high-risk phishing scam that tricks Indian companies into losing crores of rupees by impersonating top executives over email.

What Is the Business Email Compromise (BEC) Fraud?

Business Email Compromise (BEC) fraud is a sophisticated cybercrime targeting employees in Indian businesses who manage financial transactions, especially accounts teams and finance officers. Unlike common phishing, BEC scams involve deep research on an organisation and impersonation of high-ranking officials, such as CEOs or CFOs, to trick companies into authorising bogus payments.

In India, BEC scams have surged in recent years, exploiting rapidly digitising corporate workflows and the widespread use of emails in business dealings. The Indian cybercrime wing, CERT-In (Indian Computer Emergency Response Team), and the RBI’s fraud monitoring cells have reported several incidents where crooks have duped companies for amounts ranging from lakhs to several crores of INR. The Intelligence Fusion & Strategic Operations Centre (IFSOC) under the Ministry of Home Affairs has also highlighted BEC fraud as a growing threat vector in India.

Corporate awareness remains low because the emails look genuine and often mimic internal communication style. Fraudsters frequently exploit public data, including company websites and LinkedIn profiles, to craft believable emails with sender addresses almost identical to legitimate ones.

How This Scam Works — Step by Step

1. Research on the Target: Fraudsters scour publicly available information — company websites, LinkedIn profiles of executives, social media — to identify the names, designations, and working habits of key employees, especially CFOs, finance heads, and accountants.

2. Email Spoofing or Look-Alike Email Creation: They create fake email addresses closely resembling legitimate ones, for example, ceo@yourcompany.co.in instead of ceo@yourcompany.com, or hack a legitimate email account.

3. Sending Fake Payment Requests: The scammer sends urgent emails to employees authorised to process payments, instructing them to transfer funds to a specified bank account, claiming the money is for confidential business deals, vendor payments, or tax obligations.

4. Pressure Tactics: The emails often demand secrecy and quick action, warning of penalties or lost business opportunities if delayed, to pressure the victim into skipping internal verifications.

5. Money Transfer and Disappearance: The victim transfers money via UPI, NEFT, RTGS, or IMPS to the fraudster’s bank account, often based on the false email. Once money moves, scammers quickly withdraw or divert funds, making recovery difficult or impossible.

6. Delayed Discovery: Victims discover the fraud only days later, when internal audits fail, or suspicious bank statements emerge, by when the scammers have vanished.

Real Warning Signs to Watch For

• 📧 Email sender address is slightly different but similar to a trusted executive’s (extra letters, different domain).
• ⚠️ Urgent request to transfer funds bypassing normal protocols or approvals.
• 🤫 Instructions to keep the transaction secret or not involve other colleagues.
• 💬 Poor grammar or unusual phrasing that doesn’t match the supposed sender’s style.
• 🔄 Requests for payment to new or unfamiliar bank accounts or UPI IDs.
• 📞 Contact phone numbers that don’t match company directories.
• 💡 Sudden changes in payment instructions or last-minute changes via email.

What Happens to Victims

Victims of BEC fraud often face massive financial loss, with crores siphoned off in minutes. Since these are business accounts, normal consumer bank safeguards like UPI transaction reversals typically don’t apply. Fraudulent transfers usually clear quickly through NEFT/RTGS, making it extremely hard to recover funds.

Emotionally, businesses become wary of email communications, leading to distrust and internal disruption. Smaller Indian enterprises suffer badly, sometimes threatening their survival. Additionally, when fraudsters use stolen Aadhaar data or carry out SIM swaps linked to company employees, they compound the damage by gaining deeper access to other sensitive corporate systems.

What RBI and CERT-In Say

The Reserve Bank of India (RBI) has issued specific advisories warning businesses of BEC fraud risks, urging enhanced email verification, two-factor approval processes for payments, and quick reporting of suspicious transactions. RBI’s fraud hotline and the 1930 cybercrime helpline are crucial contact points for affected corporations.

CERT-In includes BEC scams among the top cyber threats in India, advising companies to implement strong email authentication methods like SPF, DKIM, and DMARC to prevent email spoofing. I4C (Indian Cyber Crime Coordination Centre) also encourages sharing BEC fraud reports centrally to prevent further losses.

How to Protect Yourself

1. Verify payment requests independently: Always call the concerned executive on official company numbers before transferring money.

2. Check email addresses carefully: Look for subtle differences — domain names, spelling mistakes, or additional characters.

3. Enable multi-level approvals: Require at least two authorisations for significant financial transactions.

4. Use secure email protocols: Ensure your company’s email system uses SPF, DKIM, and DMARC to block spoofed emails.

5. Train employees regularly: Educate staff on recognising BEC fraud and following strict protocols.

6. Avoid sharing sensitive info: Limit what employee details are publicly accessible on social media and websites.

7. Monitor bank statements daily: Track all outgoing payments for any irregularities and act fast if suspicious.

What to Do If You've Been Targeted

• Immediately inform your bank and request to block/freeze suspicious transactions or accounts.
• Report the incident to the RBI’s fraud helpline and file a complaint with CERT-In or at cybercrime.gov.in.
• Call the national cybercrime helpline at 1930 for advice and support.
• Inform all company stakeholders and strengthen internal controls to prevent further damage.
• Preserve all email trails and evidence for investigation.
• Consider informing your organisation’s IT security team and, if necessary, law enforcement authorities.

Frequently Asked Questions

Q: Can BEC fraud happen only via email?
A: While email is the primary channel, scammers can also use fake phone calls (vishing) or WhatsApp messages pretending to be executives to initiate fraudulent transactions.

Q: Is there any way to get back money lost to BEC fraud?
A: Recovery is very difficult due to how fast scammers move money. Immediate reporting to banks and cybercrime authorities increases chances of freezing or tracing funds, but many victims lose their money permanently.

Q: Why is BEC fraud so common in Indian companies?
A: Rapid digitalisation combined with inadequate employee training, weak verification processes, and the public availability of company personnel data on LinkedIn and websites make Indian firms attractive targets.

BEC fraud can cripple businesses financially and emotionally. Always verify suspicious payment requests thoroughly and report doubts immediately. If you receive scammy emails or messages asking for money, don’t take chances — verify every detail at BharatSecure.app first! Stay vigilant and protect your business from falling prey to cyber fraud.