Business email compromise (BEC)
A fraud pattern in which a criminal impersonates a trusted party, such as a title company, vendor, or employer, through a fraudulent or hijacked email account, in order to redirect a legitimate wire transfer or ACH payment to a criminal-controlled account. BEC is one of the most commonly reported categories in FBI IC3 annual reporting.
Defined in 2 GAGE programs, which carry 6 distinct definitions of it. The wording above is taught in Senior AI Scam Defense.
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
A fraud pattern in which a criminal impersonates a trusted party, such as a title company, vendor, or employer, through a fraudulent or hijacked email account, in order to redirect a legitimate wire transfer or ACH payment to a criminal-controlled account. BEC is one of the most commonly reported categories in FBI IC3 annual reporting.
A targeted phishing attack where an attacker impersonates a trusted business contact (executive, vendor, colleague) to trick the recipient into transferring funds, sharing credentials, or taking other harmful actions. AI has made BEC attacks more convincing and more frequent.
A fraud in which an attacker impersonates an executive, vendor, or trusted party (often by email, increasingly reinforced with AI voice or video) to induce a fraudulent payment or data disclosure.
A fraud pattern in which a criminal spoofs or compromises a business or organizational email account to trick an employee into wiring funds to a fraudulent account, often disguised as a routine vendor payment or executive instruction. A major category of Financial Fraud Kill Chain recoveries.
A fraud scheme in which a criminal impersonates a company executive, vendor, or trusted contact by email to trick an employee into wiring company funds to a fraudulent account; the stolen funds are frequently routed through money mule accounts before reaching the criminal's own accounts.
Where it is taught
The exact lessons this term appears in. The first module of every program is free with a free account.
- Online Safety, Privacy, and Data Basics · Digital Foundations, Certified AI Practitioner: Workplace Foundations
- AI-Specific Threat Detection · AI Security Fundamentals, Certified AI Practitioner: Workplace Foundations
- The eight rails and which ones give money back · Know Your Money Rails, Senior AI Scam Defense
- Wire Transfers: The Hours That Decide Everything · Know Your Money Rails, Senior AI Scam Defense
- The Job That Moves Money: Why You Must Never Be the Mule · Account and Asset Theft, Senior AI Scam Defense
- Out of Band Verification for Any Resident Initiated Large Transfer · CSFDP: Facility Protocols and Incident Command, Senior AI Scam Defense
Where it shows up at work
A definition is where Business email compromise (BEC) starts. The lessons above teach it inside the competencies below, which are what job descriptions ask for and what the GAGE credential records. Every link here is drawn from the same careers map that builds a role's readiness check.
Recognizes AI-enabled fraud, from cloned voices and synthetic video to romance and investment scams, and knows the one move that breaks the script.
One lesson on this page teach it as a primary outcome.
Understands prompt injection, data poisoning, model theft, insecure integrations and excessive agent privileges, and the controls that reduce each.
One lesson on this page teach it as a primary outcome.
Builds minimization, purpose limitation, de-identification, consent and retention into an AI system before launch, with tests that prove it.
One lesson on this page teach it as a primary outcome.
Roles that hire for it
Each role page shows the full competency set, what the seat decides, and a readiness check against your own evidence.
- AI Privacy Engineerneeds it at depth · 6 open postings this week
- Chief Information Security Officer, AI security focusneeds it at depth
- Chief Technology Officer, AI engineering editionneeds it at depth
- AI Incident Response Leadneeds it at depth · 1 open posting this week
- AI Security Architectneeds it at depth · 8 open postings this week
- AI Governance Engineerneeds it at depth · 7 open postings this week
How job descriptions say it
Postings rarely use the textbook word. These are the phrases the careers map reads as asking for the competencies above.
Where the frameworks place it: FTC guidance; FinCEN elder financial exploitation advisory; OWASP Top 10 for LLM Applications; Google SAIF.
One interview question about it
A caller sounds exactly like a colleague and asks for a transfer. How do you tell a voice clone from a person, and what is the rule?
Asked of candidates for deepfake, voice-clone and scam recognition. Answering it in your own words is exactly how a GAGE topic is passed, and the credential records the pass where an employer can check it.
If you come from another field
Some backgrounds already carry this competency, and the readiness check gives credit for it.
- Elder services, social work, banking front line and fraud teams carries it as a claim to back up: Fraud patterns are familiar; the synthetic versions are new.
- Cybersecurity and IT carries it as a claim to back up: Threat modeling and control design transfer; the AI-specific threats are new.
- A computer science or software engineering degree carries it as a claim to back up: Security fundamentals are a course you took, not yet a control you ran.
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.