No malware. No hacking tools. Just one email and $3 billion.
The FBI reported more than $3 billion in losses from business email compromise (BEC) in 2025. Verizon's 2026 research on small business insurance claims found BEC accounted for about 19% of claims, second only to ransomware.
BEC doesn't make headlines the way ransomware does. There are no locked screens or ransom notes. Money just goes to the wrong place, and by the time anyone notices, it's usually gone.
How a typical BEC attack unfolds
1. Get into a mailbox. Attackers phish an employee or a vendor and steal their email login, often bypassing weak MFA.
2. Watch quietly. They read email for days or weeks, learning who pays whom, when invoices go out, and how people write.
3. Hide their tracks. They create inbox rules that move or delete replies, so the real account owner doesn't see the conversation.
4. Strike at the right moment. Right before a payment is due, they send a message from the real account, in the real thread: "Our bank changed. Please use the updated account details."
5. Move the money. Funds land in an account controlled by the criminals and are moved out quickly.
Because the email comes from a legitimate address, spam filters and spelling checks don't help. It looks exactly like business as usual.
Common BEC scenarios in Tampa Bay
• A contractor's "new" banking details arrive right before a big project payment
• A title company or closing attorney's email is spoofed during a real estate deal
• An employee's payroll direct deposit change request comes through HR email
• A vendor invoice is altered with a new account number
The one rule that stops most BEC
Any change to payment details gets verified by phone, using a number you already have on file. Not the number in the email. Not the number in the signature. A number you trust from before the request arrived.
Write it down. Train it. Make it non-negotiable, even when the request seems urgent or comes from leadership.
Supporting controls that make BEC harder
• Phishing resistant MFA or passkeys to protect your own mailboxes
• Alerts for new inbox forwarding and deletion rules, a classic sign of a compromised account
• Email authentication (SPF, DKIM, and DMARC) so criminals can't easily spoof your domain
• Dual approval for new payees and changed bank accounts
• Security monitoring that flags logins from unusual locations
For Florida insurance agencies
Agencies send and receive premium payments, issue refunds, and pay commissions. Each one is a target. Rule 69O-128.032 expects licensees to maintain safeguards appropriate to their risks, and payment verification procedures are a clear, documentable control. Your cyber insurance carrier will likely ask about it too.
Verify before you pay
Business email compromise works because it feels routine. The defense works because it's routine too. Make the call-back rule part of everyday business, and one of the costliest cybercrimes becomes one of the easiest to stop.
Main Event Managed Services helps Wesley Chapel and Tampa Bay businesses secure email, set up authentication, and build payment verification procedures. Learn more at maineventmsp.com.
Sources: Total Assure, citing FBI and Verizon 2026 · DeepStrike, citing Verizon 2026
