{"id":2016,"date":"2026-01-14T16:15:38","date_gmt":"2026-01-14T15:15:38","guid":{"rendered":"https:\/\/showcase-preprod.neverhack.dev\/b\/?p=2016"},"modified":"2026-02-10T09:47:24","modified_gmt":"2026-02-10T08:47:24","slug":"bec-fraud-or-ceo-fraud-how-does-it-work","status":"publish","type":"post","link":"https:\/\/neverhack.com\/b\/en\/blog\/bec-fraud-or-ceo-fraud-how-does-it-work\/","title":{"rendered":"BEC fraud or CEO fraud: how does it work?"},"content":{"rendered":"\n

The BEC (Business Email Compromise) fraud, also known as CEO fraud, is a scam in which an attacker impersonates a trusted figure within a company. The attacker aims to convince someone\u2014typically from management, finance, or executive leadership\u2014to initiate a transfer, share sensitive information, or modify banking data.<\/p>\n\n\n\n

Unlike other attacks, this one usually does not involve a virus, a suspicious file, or an odd link. Instead, attackers rely on deception. They use emails that appear legitimate, a convincing tone, and an urgent situation. As a result, recipients may act without careful thought.<\/p>\n\n\n\n

How attackers operate<\/strong><\/h2>\n\n\n\n

A BEC attack generally follows this pattern:<\/p>\n\n\n\n

First,<\/strong> attackers study the company and its key personnel. They analyze roles, hierarchies, suppliers, and routines.<\/p>\n\n\n\n

Next,<\/strong> attackers impersonate an identity. They may create a domain nearly identical to the real one. In some cases, they compromise a legitimate account using stolen credentials<\/a>.<\/p>\n\n\n\n

Then,<\/strong> attackers craft a credible and urgent message. The email typically requests a transfer, a change of bank account, or another sensitive action that \u201ccannot wait.\u201d<\/p>\n\n\n\n

The objective is to bypass internal procedures. <\/strong>Attackers encourage victims to act alone and avoid verification with others.<\/p>\n\n\n\n

Finally, once the victim makes the payment, the funds disappear. Attackers usually transfer the money to foreign accounts and move it multiple times to hide its trail.<\/p>\n\n\n\n

Common warning signs<\/strong><\/h2>\n\n\n\n

An email linked to BEC fraud often includes:<\/p>\n\n\n\n