Oct 30, 2026 · @Paul Rentz
It rarely looks like fraud
Picture this. Your bookkeeper gets an email from a supplier you’ve paid for years. Same signature, same tone, and it’s sitting in the same thread as last month’s invoice. The note says the company changed banks and asks that this week’s $48,000 payment go to the new account. She updates the payment details and sends the wire.
Two weeks later, the real supplier calls asking where their money is.
That’s business email compromise, or BEC. There was no virus, no ransom note, and nothing that looked like an attack. It was just a convincing email at the right moment. It’s one of the costliest cyber losses small and mid-size businesses face, and it often goes unnoticed until the money is long gone.
The FBI’s numbers show how big it is. In 2025, the Internet Crime Complaint Center (IC3) received 24,768 BEC complaints with reported losses of about $3.05 billion, up from 21,442 complaints and $2.77 billion in 2024 (2025 IC3 Annual Report). Those are only the losses people reported.
How it happens
BEC comes in a few flavors, but they all depend on the same thing: someone trusting an email they shouldn’t.
Mailbox takeover. A criminal gets into a real email account, usually through a phishing link, a reused password, or a login with no multi-factor authentication (MFA). Then they wait and read. They learn who pays whom, when invoices go out, and how your people write. When the timing is right, they step into a live conversation from the real account. Many also set up hidden inbox rules that forward or delete messages, so the real owner never sees the replies.
Lookalike domains. The email comes from a domain that’s one character off, like “yourcompany-billing.com” instead of “yourcompany.com,” or an “rn” standing in for an “m.” On a phone, you won’t catch it.
Payment-instruction changes. This is the most common ask. A vendor, a title company, a contractor, or a client “has a new account.” Payroll direct deposit changes and gift card requests from “the boss” work the same way.
Impersonating an executive or owner. A short, urgent note from the owner’s email asks an employee to handle a wire quietly and quickly.
Why it works: the message looks routine, the request is plausible, and there’s pressure to act fast. Nothing trips an antivirus program, because the only thing that’s been hacked is the conversation. A bank sees an authorized customer sending a wire. And by the time anyone notices, the funds have usually moved through more than one account.
The controls that work are mostly process, not technology. Call the vendor at a number you already have on file before changing any payment instructions. Require a second approval on wires and ACH changes. Turn on MFA for every email account. Check for unfamiliar forwarding rules.
What to do when it happens
Speed matters more than anything else. Recovering a fraudulent wire gets harder with every hour. Work through these in order, and make the first two calls before you do anything else.
- Call your bank. Ask for a wire recall or ACH reversal and ask them to contact the receiving bank. Give them the date, amount, and account details from the payment.
- Call your insurance agent. Cyber policies have notice requirements, and many come with a claims hotline and a set of approved response vendors. Calling before you hire your own IT or legal help can keep you from running into policy conditions.
- Lock the account down. From a device you trust, change the password, sign out all active sessions, and turn on MFA. Look for inbox forwarding rules and unfamiliar connected apps, and remove them.
- Preserve everything. Don’t delete the suspicious emails, and don’t wipe or reimage devices. Keep wire confirmations, email headers, and a written timeline of who did what and when.
- Report it. File a complaint at ic3.gov, the FBI’s Internet Crime Complaint Center, and make a local police report. Reporting quickly gives law enforcement a chance to work with banks to freeze funds, and carriers often ask for the report number. In 2025, the FBI’s Financial Fraud Kill Chain froze about $679 million of $1.16 billion in attempted thefts it handled, a 58% success rate, and IC3 says time is of the essence ([2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)).
- Warn the people on the other end. Call your vendors, clients, and employees (not by email from the affected account) and tell them to verify any payment changes by phone until you’ve cleaned things up.
- Figure out what else was exposed. If the mailbox held personal information like Social Security numbers or bank details, you may have notification obligations. Your attorney can tell you what applies.
Once the dust settles, add a call-back rule for payment changes and a second approver on wires, and have your IT provider confirm MFA is on everywhere.
How cyber insurance helps
A cyber policy won’t stop a BEC, but it can take a lot of the weight off when one hits. Coverage varies by carrier and policy form, but most cyber policies are built around a few pieces.
Incident response. After a compromise, you need to know how far it went. Many policies pay for forensic investigators to work out which accounts were accessed and what data was exposed, along with breach counsel and notification costs if personal information was involved. Most carriers also have a claims hotline, so you’re not hunting for a vendor in the middle of a bad day.
Business interruption and recovery. If the incident knocks out email or your systems, some policies cover lost income and extra expenses while you get back up, and the cost of restoring data.
Liability. If a compromised mailbox exposes a client’s information, the policy may respond to the claims and regulatory actions that follow.
Funds transfer fraud and social engineering. This is the piece that speaks directly to BEC, and it’s where the fine print matters most. Coverage for money you voluntarily sent to a criminal is often written as a sublimit, which means a cap that’s well below the policy’s main limit. Some policies also condition it on you following a verification procedure, such as a call-back to confirm payment changes. Some carriers handle this under a separate commercial crime policy or an endorsement instead.
So when you look at a quote, don’t stop at the headline limit. Ask what the social engineering limit is, whether there’s a waiting period or a verification requirement, and whether the policy covers the investigation costs even if the money isn’t recovered.
One more thing to know: carriers ask about your controls at application, usually MFA, email security, and payment verification procedures. Answer accurately. Those answers are part of the policy, and the controls themselves are also what keep you from filing a claim in the first place.
This is a summary for planning purposes, not a description of any specific policy. Coverage decisions are made by the carrier under the actual policy language, so read the full policy, and call us with questions.
Where to get it
Cyber coverage is sold two main ways. Some business owners’ policies (BOPs) include a small cyber endorsement, often with low limits and tight sublimits. Or you can buy a standalone cyber policy, which usually has higher limits, broader coverage, and more room to tailor it to how you operate. Many businesses end up with a mix, and the gaps between the two are worth a look.
The best way to buy it is through an independent agency. We’re not tied to one carrier, so we can compare coverage from several markets side by side. That matters with cyber, because policy forms differ a lot, especially on social engineering limits, waiting periods, and verification conditions. We’ll also help you fill out the application accurately, since the answers matter if you ever have to file a claim, and we’re in your corner if you do.
If you want a quick review, it helps to have these on hand: your current policies, your approximate annual revenue and number of employees, who hosts your email, whether MFA is turned on, and how you handle payment changes today.
Call Rentz & Rentz Insurance in Baxley for a cyber coverage review. We’ll look at what you have, show you where the gaps are, and get you quotes. Phone (912)367-1479 or email service@rribaxley.com
This article is for general information only and is not a description of any specific policy or a guarantee of coverage. Coverage is subject to the terms, conditions, and exclusions of the policy as issued. Consult your attorney for legal questions about notification or reporting obligations.
Source: FBI IC3 2025 Internet Crime Report, BEC figures from the by-complaint count and loss tables and the three-year comparison tables.