What Is Business Email Compromise? Inside the 90.7% Spoofing Gap

Published 2026-08-21

Business email compromise (BEC) is a fraud in which a criminal sends email that appears to come from someone the victim trusts — a chief executive, a supplier, a lawyer, an internal colleague — to trick them into moving money or handing over data. It is not a technical hack in the usual sense: nothing is breached, no malware is planted, no password is stolen in the classic case. It is a confidence trick delivered over an email channel that was never designed to prove who a sender really is. The reason the most convincing BEC attacks work is a single measurable gap: the target’s own domain can be forged. The August 2026 defaults.exposed census graded 376,928,750 domains for email authentication and found that 90.7% — 341,945,132 domains — publish no enforcing DMARC policy, which means a receiving mail server has never been told to reject mail that forges them. That is the exact-domain spoofing gap, and it is what turns a plausible impersonation into an unanswerable one.

BEC is consistently one of the costliest categories of cybercrime by dollar loss, and almost none of that cost comes from sophisticated intrusion. It comes from an email that looked right arriving at a person with the authority to act on it. The figures throughout come from the defaults.exposed August 2026 census, an independent scan of 432,127,908 domains graded as of 2026-08-16.

What is business email compromise?

Business email compromise is a targeted email fraud that exploits trust rather than technology. The attacker impersonates a party the recipient already deals with and uses that borrowed authority to request an action with a financial consequence: pay this invoice, change these bank details, buy these gift cards, release this payroll file, wire this deposit before the deadline.

Three features distinguish BEC from ordinary phishing:

It targets a specific person for a specific outcome. Where bulk phishing sprays millions of identical links, BEC is researched. The attacker knows who signs off payments, who the real suppliers are, and when a large transaction is plausible.
It usually carries no malicious payload. There is often no link to a fake login page and no attachment to detonate. The message is plain text asking a human to do something. That is precisely why malware scanners and link filters miss it.
It relies on the target’s identity being borrowable. The single most convincing version of BEC does not merely look like it came from a trusted domain — it genuinely passes the from-address a human reads, because the domain can be spoofed at the protocol level.

That last feature is where measurement matters. Impersonation lives on a spectrum, and where an attack sits on it is decided by the target’s own email-authentication posture, not the attacker’s skill. This article is the definitional hub for the whole family. The mechanics of how a forged message is constructed and delivered are covered in depth in Email Spoofing Explained: Why 90.7% of Domains Can Be Forged; this piece is about the fraud that sits on top of it.

How does business email compromise work, step by step

A BEC attack is a sequence, not a single event. Understanding the sequence is what lets you break it, because each stage offers a control that stops the one after it.

Reconnaissance. The attacker maps the target: who holds budget authority, who the suppliers and clients are, the invoicing rhythm, the language and sign-offs people use. Much of this is public — websites, press releases, social profiles, leaked address books, out-of-office replies.
Impersonation setup. The attacker chooses an identity to wear. This is the decisive fork. Either they register a look-alike domain (a lookalike of the real one — a swapped letter, a different top-level domain) and hope the recipient does not scrutinise the address, or, where the target’s domain permits it, they forge the exact domain so the from-address is genuinely correct.
The pretext. A message arrives with a believable story and a reason to act now: a supplier’s bank has changed, an acquisition must stay confidential, the CEO is travelling and needs a payment released before a cut-off. Urgency and authority suppress the recipient’s instinct to verify.
The action. The victim wires the money, updates the payee record, or sends the file. Because the request looked internal or came from a known counterparty, it clears the normal checks.
The cash-out. Funds move quickly through intermediary accounts and are gone before the fraud is noticed. Recovery windows are measured in hours.

Stage 2 is the one your domain controls. If your domain enforces DMARC, the attacker is pushed off exact-domain forgery and down onto a look-alike domain — still dangerous, but visibly wrong to an alert reader and blockable by other controls. If your domain does not enforce DMARC, stage 2 costs the attacker nothing and stage 3 becomes far more convincing, because the message genuinely comes from you.

The five BEC types the FBI IC3 tracks

The FBI’s Internet Crime Complaint Center (IC3) has long described BEC through five recurring scenarios. They are worth knowing by name, because a control that stops one may do nothing for another.

Bogus invoice / supplier swindle. A known supplier is impersonated and asked to be paid to a new account, or a real invoice is intercepted and its bank details altered. This is the highest-volume money-mover of the five. Its specific prevention — verifying banking-detail changes out of band — is covered in Invoice Fraud Prevention: Closing the Domain-Spoofing Gap Behind BEC.
CEO fraud (executive impersonation). A senior leader is impersonated to instruct a subordinate to make an urgent transfer. Authority plus urgency is the whole play. Why publishing DMARC alone does not close this — the internal look-alike problem — is unpacked in CEO Fraud Explained: Why Publishing DMARC Is Not Enough.
Account compromise. A genuine employee mailbox is taken over (via phished credentials or a stolen session) and used to send fraud from a real, fully-authenticated account. Here DMARC will not help — the mail is legitimately from you — which is why BEC defence is layered, not single-control.
Attorney impersonation. A lawyer or law firm is impersonated around a sensitive, time-pressured matter — a completion, a settlement, an acquisition — where confidentiality is the excuse that discourages the victim from checking.
Data theft. Rather than money, the ask is information: payroll records, tax forms, an employee directory. The stolen data then fuels the next, better-targeted round of fraud.

Two of these five — bogus invoice and CEO fraud — are most often delivered by forging the trusted domain, which is exactly the exposure the census measures. Account compromise, by contrast, defeats sender authentication because the sender is real; it is stopped upstream, by protecting the mailbox itself.

Why 90.7% of domains are wide open to exact-domain spoofing

Email was built on a protocol, SMTP, that does not verify the from-address a human sees. Three DNS-published standards were layered on afterwards to close that gap: SPF (RFC 7208) lists who may send for a domain, DKIM (RFC 6376) signs messages cryptographically, and DMARC (RFC 7489) ties both to the visible from-address and — crucially — tells receiving servers what to do when a message fails. Only DMARC, set to an enforcing policy, actually instructs a receiver to reject a forgery.

That instruction is what most of the internet has never given. Of the 376,928,750 domains graded in the August 2026 census, 341,945,132 — 90.7% — publish no enforcing DMARC policy. For every one of those domains, a receiving mail server has no standing instruction to refuse mail that forges the exact domain. The from-address the victim reads can be genuinely, precisely correct.

The gap is not only “no record at all.” A domain can publish a DMARC record that looks protective and does nothing:

Domains at p=none publish DMARC but tell receivers to take no action on failures — monitor only. A basic checker shows a record; the domain is spoofable anyway.
56.8% of domains — 214,276,774 — publish neither SPF nor DMARC, so there is no email-authentication posture at all. That silent majority is profiled in The Silent Domain.
Even among domains that publish SPF, the majority use the weaker soft-fail setting, and many never add the enforcing DMARC layer that would make SPF meaningful against exact-domain forgery.

The uncomfortable arithmetic is that impersonating most organisations by exact domain requires no exploit. The attacker looks up a public DNS record — the same one you can look up — sees no enforcing policy, and forges away. The mechanics of that forgery, field by field, are in Email Spoofing Explained; the grading logic for the policy tag that decides it all is in the DMARC policy methodology.

Does your domain enforce DMARC? Only 9.3% do

The number that decides your BEC exposure is not whether you have a DMARC record — it is whether that record enforces. Enforcement means the policy tag reads p=quarantine (send forgeries to spam) or p=reject (refuse them outright). Anything else — no record, or p=none — leaves the domain exactly as forgeable as one that never tried.

Across the census, only 34,983,618 domains — 9.3% — reach an enforcing policy. Fewer than one domain in ten has actually told the world’s mail servers to stop forgeries. And full protection is rarer still: only 10,902,284 domains — 2.9% — publish the complete stack of SPF, DKIM, and an enforcing DMARC policy together.

There is a large, quietly reassuring-looking middle group that is worth calling out, because it is the group most likely to believe it is safe. Many domains publish a DMARC record stuck at p=none, or publish SPF and DKIM but never enforce DMARC on top. Roughly 87 million domains sit in that one-record-from-safety position — everything in place except the instruction that matters. That specific population, and the single edit that would protect it, is quantified in the twin report, DMARC Gap: 87 Million Domains One Record From Safety.

The practical takeaway for anyone assessing their own risk: a green tick that says “DMARC record found” is not the answer. The question is whether the policy is p=reject at full coverage, whether subdomains inherit it, and whether your legitimate senders align. On the whole internet, fewer than one domain in ten can say yes. Check your domain free at defaults.exposed to see which side of that line yours falls on — it reads your live policy from public DNS in about 30 seconds and tells you plainly whether you can be exact-domain forged.

How to prevent business email compromise

BEC defence is layered because the five attack types do not share a single choke point. No one control stops all of them; the goal is to remove the easy paths and add friction to the rest. The three layers below, in order of leverage, cover the vast majority of real-world losses.

1. Close the exact-domain spoofing gap: enforce DMARC

This is the highest-leverage control and the only one that is free, permanent, and stops forgery before it ever reaches a human. Moving your domain to an enforcing DMARC policy takes exact-domain impersonation — the most convincing kind — off the table entirely. The path is well-trodden and low-risk when done in order:

Publish p=none with a monitored rua= reporting address. This breaks nothing and starts the flow of aggregate reports showing every service that sends as you.
Read the reports and align your real senders. Over two to four weeks, bring your mail platform, CRM, invoicing tool, and newsletter provider into SPF and DKIM so legitimate mail passes.
Tighten to p=quarantine, then p=reject, at full coverage with a matching subdomain policy. Forged mail is now refused; subdomains inherit the protection.

Each step is a single DNS edit. The grading logic for each stage is documented in the DMARC policy and DMARC reporting methodology, and the building blocks in the SPF and DKIM methodology pages. One caution, expanded in the CEO-fraud article: enforcing DMARC stops exact-domain forgery, not look-alike domains — so it is necessary, but not sufficient on its own.

2. Verify money and data changes out of band

Because account-compromise and look-alike-domain BEC can produce mail that passes authentication or reads as almost-correct, the second layer assumes the message might be fraudulent regardless of how it looks. The rule is procedural: any change to bank details, any unusual or urgent payment, and any request for sensitive data is confirmed through a different channel than the one the request arrived on — a phone call to a known number, never the number in the email. This is the control that catches the bogus-invoice scheme even when the domain is perfectly forged; it is covered in depth in Invoice Fraud Prevention.

3. Train the humans and protect the mailboxes

The people with payment authority need to recognise the pressure signals — urgency, secrecy, authority, a change to established process — and to feel safe pausing to verify without fear of second-guessing a senior. Alongside training, protect the accounts themselves with phishing-resistant multi-factor authentication, because account-compromise BEC sends fraud from a genuine, fully-authenticated mailbox that no sender-authentication control can catch. Increasingly, this combination is not optional: cyber insurers now check for enforcing email authentication and MFA as a condition of cover, as detailed in Cyber Insurance Requirements 2026: The Email Controls Underwriters Check.

Warning signs of a BEC email

No single tell is proof, but BEC messages cluster around a recognisable set of pressure signals. Any one of them should trigger the out-of-band check described above — not because the mail is certainly fraudulent, but because the cost of verifying is minutes and the cost of not verifying is the transfer.

A change to established process. A supplier who has always invoiced to the same account suddenly has “new banking details,” or a payment that normally follows a purchase order arrives as a direct request.
Urgency with a deadline. The transfer must happen today, before a cut-off, ahead of a close. Urgency exists to stop you pausing to verify.
Secrecy or exclusivity. “Keep this between us until the deal is announced.” Confidentiality is used to isolate the target from the colleague who would have caught it.
Authority applied downward. A request from a senior leader to a junior with payment access, phrased to make questioning it feel like insubordination.
A reply-to that differs from the from-address, or a from-address that is a look-alike of the real domain — a swapped letter, an extra word, a different top-level domain. On a domain that enforces DMARC, attackers are pushed onto exactly these visible look-alikes, which is why enforcement plus an alert reader is a strong pair.
A channel mismatch. The request arrives only by email and resists moving to a phone call on a known number.

The trap is that when the domain is forged exactly, the from-address itself is not a warning sign — it is genuinely correct. That is why domain-level enforcement matters: it removes the one signal a careful reader cannot otherwise catch, and forces every impersonation into the visible-look-alike column where the other signs still apply.

What this means

For business owners and finance teams, BEC is the cybercrime most likely to take real money out of the business, and the entry cost for the attacker is often just a public DNS lookup that shows your domain is forgeable. The people defrauded in your name are usually your own customers and suppliers, paying fake invoices that appeared to come from you.

The first move is free: find out whether your own domain enforces DMARC, because at a 9.3% enforcement rate across the internet the base-rate answer is that it does not. Closing the exact-domain gap is an afternoon of work, and it removes the single most convincing weapon an impersonator has.

For IT and security teams, BEC exposure is a measurable posture, not a vague threat. Reduce it in layers: enforce DMARC to kill exact-domain forgery, add out-of-band verification for money and data changes to catch the look-alike and account-compromise variants, and protect mailboxes with strong MFA.

Treat “we have a DMARC record” as the start of the audit, not the end — p=none is monitoring, not protection, and a stakeholder who saw a green result may believe otherwise. The census figures make the case for prioritisation: 90.7% no enforcing DMARC, 56.8% with no email authentication at all, and only 2.9% fully protected.

For MSPs and IT providers, every client domain is one DNS record edit away from removing its exact-domain BEC exposure, and most have never been shown where they stand. A single scan turns an abstract risk into a client-ready finding.

FAQ

What is business email compromise? Business email compromise is a targeted email fraud in which an attacker impersonates a trusted party — an executive, supplier, lawyer, or colleague — to trick a victim into transferring money or handing over data. Unlike bulk phishing, it is researched, aimed at a specific person with authority to act, and usually carries no malicious link or attachment, which is why traditional filters miss it. Its most convincing form forges the target’s exact domain, a gap the August 2026 census measured across 376,928,750 domains: 90.7% publish no enforcing DMARC and can be exact-domain spoofed.

How does business email compromise work? It runs as a sequence: reconnaissance to learn who holds budget authority and who the suppliers are; impersonation setup, where the attacker either registers a look-alike domain or forges the target’s exact domain; a pretext message using urgency and authority to demand an action; the action itself — a wire, a changed payee, a released file; and a fast cash-out through intermediary accounts. The decisive stage is impersonation setup, which your own domain controls: enforcing DMARC forces the attacker off exact-domain forgery. Only 9.3% of the 376,928,750 domains graded in the census actually enforce it.

How do I prevent business email compromise? Defend in three layers, because no single control stops all five BEC types. First, enforce DMARC (p=quarantine or p=reject) to eliminate exact-domain forgery — the free, highest-leverage step. Second, verify every bank-detail change and urgent payment out of band, through a known phone number rather than the email channel, which catches look-alike and account-compromise fraud. Third, train the people with payment authority and protect mailboxes with phishing-resistant MFA. Start by finding out where you stand: check your domain free at defaults.exposed, which reads your live DMARC policy in about 30 seconds.

Does cyber insurance cover business email compromise? Many cyber insurance policies do cover BEC losses, but increasingly only when specific controls are in place — and the coverage terms, sub-limits, and exclusions vary widely, so this is not legal or financial advice; read your own policy and speak to your broker. Underwriters now routinely check for enforcing email authentication (DMARC), phishing-resistant multi-factor authentication, and documented out-of-band payment-verification procedures before binding or paying a claim. A domain sitting at no enforcing DMARC — the position 90.7% of domains occupy — is exactly the kind of gap an underwriter flags. The email controls insurers look for are set out in Cyber Insurance Requirements 2026.

What is a different name used for business email compromise? BEC is also called email account compromise (EAC) when a genuine mailbox is taken over, and it overlaps heavily with the terms CEO fraud, executive impersonation, whaling, invoice fraud, supplier swindle, and wire-transfer fraud — each naming a specific BEC scenario rather than a different crime. The FBI’s IC3 groups them under business email compromise / email account compromise. Whatever the label, the enabling weakness for the exact-domain variants is the same: a spoofable domain. The census found only 2.9% of the 376,928,750 domains graded are fully protected against that weakness with SPF, DKIM, and enforcing DMARC together.

Data to cite

“90.7% of domains — 341,945,132 of the 376,928,750 email-graded in the August 2026 census — publish no enforcing DMARC and can be exact-domain spoofed, the gap behind BEC’s most convincing impersonations.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“Only 9.3% of domains — 34,983,618 — publish an enforcing DMARC policy (p=quarantine or p=reject).” — defaults.exposed August 2026 Domain Security Census (432M domains)
“Only 2.9% of domains — 10,902,284 — are fully email-authentication protected with SPF, DKIM, and enforcing DMARC together.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“56.8% of domains — 214,276,774 — publish neither SPF nor DMARC, leaving no email-authentication posture at all.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“The August 2026 census scanned 432,127,908 domains and graded 376,928,750 for email authentication as of 2026-08-16.” — defaults.exposed August 2026 Domain Security Census (432M domains)

See where your own domain stands

Business email compromise is not, at root, a technical break-in — it is a trust trick that works best when the target’s own domain can be forged. For 90.7% of domains, that forgery costs an attacker nothing but a public DNS lookup, and most owners have never seen their exposure stated plainly.

Check your domain free at defaults.exposed — it reads your live SPF, DKIM, and DMARC records straight from public DNS and tells you instantly whether your policy actually enforces, whether your subdomains are covered, and whether your domain can be exact-domain spoofed for a BEC attack. Takes 30 seconds. No account needed. If you want the gaps closed and kept closed — enforcing DMARC done right, with ongoing monitoring so a change never silently re-opens the door — see how the fix works.

Read the flagship census report: The State of Domain Security 2026 →

Aggregate data only. Data stored and processed in the EU.

Data source: defaults.exposed August 2026 census, methodology v9, as of 2026-08-16. 376,928,750 domains graded for email authentication from 432,127,908 scanned. All figures are counts of graded domains. References: RFC 7489 (DMARC), RFC 7208 (SPF), RFC 6376 (DKIM); FBI IC3 BEC scenario definitions.

How to cite this report

Press / blog: defaults.exposed (2026). What Is Business Email Compromise? Inside the 90.7% Spoofing Gap. defaults.exposed August 2026 Domain Security Census (432,127,908 domains scanned, asOf 2026-08-16). Retrieved from https://defaults.exposed/v9/articles/what-is-business-email-compromise-inside-the-90-7-spoofing-gap

Academic: defaults.exposed. (2026, August 21). What Is Business Email Compromise? Inside the 90.7% Spoofing Gap. In defaults.exposed Domain Security Census: August 2026. https://defaults.exposed/v9/articles/what-is-business-email-compromise-inside-the-90-7-spoofing-gap

In-line citation: (defaults.exposed, August 2026 Domain Security Census, n=376,928,750 email-graded domains)

About the defaults.exposed August 2026 Census

The defaults.exposed Domain Security Census is a recurring independent measurement of the public domain namespace. The August 2026 edition scanned 432,127,908 domains between 1–16 August 2026 and graded 376,928,750 of them for email authentication using methodology v9. Scans are conducted from EU infrastructure. No individual domain, registrant, or business is named in any report. All figures are aggregate distributions. Data is stored and processed within the EU.

Methodology: defaults.exposed/v9/methodology Full census report: defaults.exposed/en/articles/the-state-of-domain-security-2026

Data sourced from the August 2026 grading methodology (v9) — 34 checks, 376 million domains. Browse the census statistics or the Census Explorer, or see all August 2026 research →