A finance employee at a Toyota subsidiary in Europe received an email from someone who appeared to be a company executive. The email authorised a payment of €37 million to a new bank account. The employee processed the transfer. The money was gone.
The email wasn’t from the executive. It was a business email compromise attack. It worked because it knew exactly the right names, the right context, and the right tone to be believable.
The short answer. Business email compromise (BEC) is a fraud where an attacker impersonates an executive, a vendor, or a colleague by email to redirect a payment to an account they control. It runs on breach data and research, not malware, so the fake looks completely legitimate. The single control that stops most BEC is verbal confirmation: before acting on any payment change or unusual wire, call the requester on a phone number already in your system, never the number in the email. Add two-person authorization for large transfers and email authentication (DMARC, DKIM, SPF). BEC is one category in the wider cyber fraud field guide.
The $37 million email
The 2019 Toyota Boshoku case is not an outlier. It’s a template.
Attackers had done their homework. They knew the executive’s name, the subsidiary’s payment workflows, the general structure of how approvals worked. The email referenced real business context. It arrived during a moment when a large transfer could plausibly be legitimate.
The FBI calls business email compromise the most financially damaging cybercrime in the world. From 2016 to 2021, BEC attacks caused $43 billion in losses globally. In 2023 alone, the FBI’s Internet Crime Complaint Center logged $2.9 billion in BEC losses — just the cases that got reported.
Recovery rate: roughly 4%. Once a wire transfer lands in an attacker-controlled account, it moves fast. The money is gone.
How attackers get the information
There are two paths into a successful BEC attack. Both start with breached data.
Path one is account compromise. An executive’s work email credentials appear in a breach database — from a third-party service, a credential-stuffing list, or a reused password. Attackers run those credentials against the corporate email system. If the password works (or a variation of it does), they’re in.
From inside the inbox, they don’t immediately do anything visible. They read. They learn the ongoing deals, the vendor relationships, the payment patterns, the names of finance team members, the format of approval requests. They watch for months sometimes. When they act, the fraud email is built on real intelligence — real invoice numbers, real vendor names, the names of real colleagues in the CC field.
Path two is impersonation without access. Attackers don’t need the actual inbox if they can build a convincing-enough fake. They register a domain that looks like yours — replacing an “m” with “rn,” adding a hyphen, swapping one letter. They harvest executive names and roles from LinkedIn. Breach data fills in personal details that make the email feel real. OSINT from company press releases and filings fills in the rest.
Path one is more dangerous because it has perfect information. Path two is more common because it requires no technical compromise of the target company.
The four main BEC scenarios
CEO fraud is the most well-known. An email from (or appearing to be from) the CEO, CFO, or another executive asks for an urgent wire transfer to a new account. The message often says: don’t go through normal channels, don’t discuss this with others yet, it needs to happen today.
Vendor fraud is subtler and arguably more effective. Attackers compromise or impersonate a vendor your company already pays regularly. They send an email — looking like a routine vendor communication — saying the vendor’s banking details have changed. Update your records to the new account number. The next payment goes straight to the attackers.
Payroll diversion targets HR and payroll departments. An email appearing to be from an employee asks to update their direct deposit information before the next pay cycle. The payroll goes to the attacker’s account. The real employee notices when their pay doesn’t arrive.
Attorney fraud targets deal closings. At the moment a real estate transaction, M&A deal, or settlement is about to close, an email arrives from someone claiming to be legal counsel, with instructions to wire funds to a specific account for escrow or closing costs.
Each scenario has one thing in common: a payment is being redirected to an account the attacker controls.
Why it works: the psychological triggers
BEC attacks work because they’re engineered to bypass the mental habits that would normally trigger scepticism.
Authority shuts down questioning. An instruction from the CEO gets processed differently than one from a peer. The normal instinct to push back gets suppressed.
Urgency eliminates deliberation. “This needs to be completed before the wire window closes today” removes the time people would normally use to verify. Urgency and verification are incompatible — attackers know this.
Secrecy blocks the most effective defence: asking a colleague. “Don’t mention this to anyone yet, the deal is sensitive” isolates the target from the one question that would stop the attack.
Familiarity creates false trust. When the email references a real vendor by name, a real invoice number, a real ongoing transaction — that specificity feels like proof. It isn’t. It’s research.
These four triggers working together are why intelligent, experienced finance professionals fall for BEC attacks. The attack is designed around human decision-making, not technical vulnerabilities.
What organisations can do
The single most effective control is a verbal confirmation policy for any payment change request or unusual wire transfer. The rule: before any payment instruction is acted on — regardless of who it appears to be from — the requestor is called on a known, pre-existing phone number. Not the number in the email. Not a callback to a number just sent in a message. A number already in your system.
This one control stops the vast majority of BEC attempts dead. Attackers cannot fake a phone call to the real executive’s known mobile number.
Beyond that:
Two-person authorisation for wire transfers above a threshold means no single employee can execute a payment without a second person confirming. The threshold matters — set it at a level where it catches real risk, not just million-dollar transfers.
DMARC, DKIM, and SPF are email authentication protocols that prevent attackers from spoofing your domain to your own employees. If your company doesn’t have these configured, check with your IT team. Domain spoofing is trivially easy without them.
External email banners — a visible tag on emails originating outside your organisation — break the illusion of internal authority. When the “CEO’s” email carries a bright banner saying “External sender,” it disrupts the authority trigger.
BEC simulation training — not just awareness presentations, but realistic simulations that test employees with actual BEC-style emails — builds the habit of scepticism in the moment.
What employees can do individually
Know your company’s wire transfer policy before you need it. If there isn’t one, raise it. The policy should specify: any payment instruction received by email requires verbal confirmation before action. That’s the floor.
Treat urgency as a warning sign, not a reason to skip steps. Legitimate executives and vendors understand that financial controls exist. If someone is pressuring you to skip verification because there’s no time, that pressure itself is information.
Treat secrecy as a red flag. Real sensitive transactions don’t require you to hide them from your finance director or compliance team. If an email is asking you to keep it quiet, it’s asking you to remove the people who would catch the fraud.
Report suspicious emails — even if you’re not sure. The cost of a false alarm is a few minutes of someone’s time. The cost of staying silent about a real BEC attempt can be millions. Many successful BEC attacks involved employees who suspected something but didn’t report it.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.