You may receive an email at work that at first glance seems legit. It’s from someone you know — an attorney, human resources (HR) rep or vendor. It could even appear to be coming from the CEO.

In reality, it is a spoofed email — one created by a fraudster to trick you into sending money and opening the door to your corporate network. This type of scam, known as business email compromise (BEC), can be one of the most financially damaging crimes online, according to the FBI. [1]

How does BEC work?

Scammers get to know their targets so they can fake their identities, even setting up an email address that appears nearly identical to their victim’s. Typically, the domain will be different by just a letter or two, or it may come from the correct email address via another domain.

Once the scammer figures out who has the authority to move money within a company, they’ll try to win trust by sending messages to that person from the fake email account. It’s often successful because recipients recognize the sender and may not notice the discrepancy in the email address.

The scam isn’t always about transferring money. Sometimes it’s used to steal confidential information, tax information, or cryptocurrency wallets.

People in roles who can authorize transfers of funds are frequent victims:

  • Executives, whose information is often publicly available;
  • Finance employees, such as controllers and accounts payable staff, who have banking details, payment methods and account numbers; and
  • HR managers who have access to employee records.

Why Is It Dangerous?

Losses from BEC totaled an estimated $3.1 billion in 2025, according to the FBI Internet Crime Report, nearly 100 times more than ransomware schemes.[2]

Despite the success of BEC scams, there are some common-sense things corporations and individuals can do to protect themselves.

“I have the same message for employees and for customers,” says Brittney DeBrouse, staff manager for Corporate & Institutional Banking Fraud Detection Operations at PNC. “It is crucial to stay alert for the threat of business email compromise. It’s important to never take an email at face value.” DeBrouse says to always check the email address carefully to see if it’s spoofed.

How Can You Avoid Being Hooked by a BEC Scam?

The FBI provides these general tips for avoiding BEC scams:

  • Be careful with what information you share online or on social media. By openly sharing things like pet names, schools you attended, links to family members and your birthday, you can give a scammer all the information they need to guess your password or answer your security questions.
  • Don’t click on anything in an unsolicited email or text message asking you to update or verify account information. Look up the company’s phone number on your own (don’t use the one a potential scammer is providing) and call the company to ask if the request is legitimate.
  • Carefully examine the email address, URL and spelling used in any correspondence. Scammers use slight differences to trick your eye and gain your trust.
  • Be careful what you download. Never open an email attachment from someone you don't know and be wary of email attachments forwarded to you.
  • Set up two-factor (or multifactor) authentication on any account that allows it and never disable it.
  • Be especially wary if the requestor is pressing you to act quickly.

If you believe you have been victimized, it is critical to take action as soon as possible. Criminals exploit the time between compromise and response to do as much damage as they can. Best practices call for you to:

  • Monitor personal financial accounts on a regular basis for irregularities, such as missing deposits; and
  • Once you’ve identified an anomaly that suggests possible compromise, contact your bank immediately so your accounts can be frozen or closed; and
  • Report the matter to the FBI’s Internet Crime Complaint Center.

To report suspicious emails that appear to come from PNC, forward the message to abuse@pnc.com. Learn more about BEC and other types of internet crimes by visiting the FBI’s Internet Crime Complaint Center. You may also visit PNC's Security & Privacy Center for updates about current scams and best practices for protecting your accounts, data and customers.