Business email compromise in South Africa explained
Business email compromise (BEC) in South Africa is email fraud aimed at the money a business pays out.
On this page8 sections
Business email compromise (BEC) in South Africa is email fraud aimed at the money a business pays out. An ITWeb TechForum piece of 30 September 2026, written by a cyber security distributor, describes BEC as criminals impersonating or taking over a trusted email account to trick a business into paying them. The first protection is a habit: before money moves, confirm any change to payment details through another channel.
In short: business email compromise is fraud in which someone poses as a boss, supplier or colleague by email to get a business to pay them. The answer is to confirm every payment change by phone, on a number you already hold.
What is business email compromise?
How does business email compromise work?
How big the problem is, and why South African bank figures leave it out
Business email compromise vs phishing: what is the difference?
Who carries the loss: what South African courts have said
How do you prevent business email compromise? A checklist
How a verifiable code or seal exposes a changed invoice or a wrong sender
Check before you pay
What is business email compromise?
The FBI's Internet Crime Complaint Center (IC3) 2025 Annual Report defines BEC as a scam aimed at businesses or individuals who work with suppliers or regularly make wire transfer payments. The IC3 report says fraudsters compromise email accounts and other channels, such as phone numbers and virtual meeting apps, through social engineering or computer intrusion so they can make unauthorised transfers of funds.
The APWG Phishing Activity Trends Report for Q4 2025 (published 18 February 2026) describes a BEC attack as one where a threat actor poses as an employee, vendor or other trusted party in an email and tries to trick an employee into sending money, privileged information or another asset.
The common thread is borrowed trust. The criminal uses a name you already rely on, so the request, not the name on it, is what needs checking.
How does business email compromise work?
Business email compromise works by placing a payment request inside a conversation that already feels routine. ITWeb gives typical South African patterns: a supplier invoice arrives with new banking details, a 'CEO' tells finance to release an urgent payment, or someone intercepts a law firm's trust account emails and quietly changes the beneficiary details. ITWeb says the email often looks right because it is the genuine thread, hijacked mid-conversation after a mailbox was compromised.
In APWG's Q4 2025 report, Fortra, a security vendor and APWG member, links the rise in BEC attacks to a group called Scripted Sparrow, whose members come from South Africa, Nigeria, the US and Turkey. Fortra estimates, in the same APWG report, that the group sends up to 6 million targeted emails a month to accounts payable teams, with bogus executive coaching invoices and a spoofed reply chain made to look as if an executive approved the expense.
The FBI IC3 2025 Annual Report notes that chat generators can quickly write official-sounding emails that mimic a CEO, and that voice cloning can be used to request wire payments. The IC3 report adds that not all BEC is AI-enabled, but businesses reported more than US$30 million in 2025 losses to BEC involving AI.
How big the problem is, and why South African bank figures leave it out
The FBI IC3 2025 Annual Report recorded 24,768 BEC complaints and US$3,046,598,558 in reported BEC losses in 2025, the largest loss category after investment fraud. The same FBI IC3 report shows 21,442 BEC complaints and US$2,770,151,146 in reported BEC losses in 2024. IC3's figures for both years count complaints made to the FBI, mostly from the United States, not South African losses.
In South Africa, SABRIC's 2025 Annual Banking Crime Statistics show that reported digital banking crime losses rose to R2.4 billion in 2025, from about R1.9 billion in 2024, with banking app-related crime making up more than 70% of those losses. ITWeb reports that SABRIC's R2.4 billion figure for digital banking crime in 2025 does not include business email compromise. None of the reports above gives a South African figure for business email compromise, and a missing local number does not mean a small risk.
Business email compromise vs phishing: what is the difference?
The difference is the goal: phishing is after your details, while business email compromise is after a payment. The FBI IC3 2025 Annual Report defines phishing/spoofing as unsolicited email, text messages or phone calls, supposedly from a legitimate company, that ask for personal, financial or login details.
ITWeb reports that most BEC emails carry no malware, malicious link or attachment. ITWeb adds that many come from a real thread on a compromised legitimate account, so they pass SPF, DKIM and DMARC checks, while others come from lookalike domains that the attackers set up and authenticated themselves. ITWeb notes that these checks confirm where an email came from, not what it is asking for.
The FBI IC3 2025 Annual Report recorded 191,561 phishing/spoofing complaints with US$215,843,126 in losses in 2025, against 24,768 BEC complaints with US$3,046,598,558 in losses. The warning signs taught for phishing, such as a strange link, may be missing from a payment request.
Who carries the loss: what South African courts have said
ITWeb reports that in Edward Nathan Sonnenberg Inc v Hawarden (2024), South Africa's Supreme Court of Appeal found that a firm which emailed banking details owed no duty of care to a non-client third party, who had been warned and could have verified the details independently. ITWeb also reports Gerber v PSG Wealth Financial Planning (2023), in which a financial services provider was held liable on contractual grounds after acting on payment instructions from a client's hacked email without verifying them.
Rules can apply differently to each business, so check what applies to yours. For a finance team, the useful question is how to stop the payment before anyone has to argue about the loss.
How do you prevent business email compromise? A checklist
The ITWeb TechForum piece was issued by Cyberwin, a cyber security distributor, and also promotes an email security product. ITWeb says a business limits its BEC liability by writing its payment checks down and applying them every time: it confirms any new banking details independently, calls back on a number it found itself rather than one given in the suspect email, uses two-factor authentication on email and banking accounts, and gives finance staff a clear internal policy to point to. ITWeb adds that courts look at whether that standard was actually applied, not just written down.
Turned into daily practice, that looks like this:
Treat any change to a supplier's banking details as unconfirmed until it has been checked through another channel.
Phone the supplier, client or colleague on a number you found yourself, never one given in the email that asked for the change, a callback step ITWeb lists.
Ask another person to approve any new beneficiary or urgent payment before it is released.
Turn on two-factor authentication for email and banking logins, one of the protocols ITWeb lists for limiting BEC liability.
Check the sender's address, but never rely on it alone: Fortra found, in APWG's Q4 2025 report (published 18 February 2026), that 69% of BEC attacks that quarter used a free webmail domain, and ITWeb reports that other BEC emails come from lookalike domains or from a genuine account that has been compromised.
Write these steps into a short payment policy and keep a note of each check you make.
How a verifiable code or seal exposes a changed invoice or a wrong sender
Authentikor's pages state that it does not judge how a message looks: a real message carries a code or seal that leads to the sender's record in the Authentikor Vault, and a fake either has none or its check shows what the seal was really issued for. That matters for business email compromise, where the danger is a message that looks right.
Authentikor's pages say a scan of a sealed invoice shows what the record was issued for, including the original invoice number, the amount and the last digits of the bank account, so if the page in front of you says something else, the change stands out. Authentikor's pages say that for an email, the scan shows the sender address and the recipients, with the recipients masked, so a message from any other address does not match. Authentikor's pages add that a copied seal reads exactly like the original, which is why the proof is the signed record and its match with your document, not the picture of the seal.
Authentikor's pages advise that if a code shows as invalid, expired or blacklisted, you should not act on the email or document, and should phone the sender on a number you already trust. Authentikor's pages state that 'nothing found' means only that it has no seal or code to show for the item; it never means the document is fake.
A check helps only when the genuine sender issued a code or seal in the first place. If a supplier's own mailbox may have been taken over, the callback still matters, so a check works alongside the checklist, not instead of it. If criminals could pose as your business, ask what your clients would have to check besides the look of your email.
Check before you pay
Before you pay on the strength of an email, look for something you can check, not just something that looks right. Authentikor's Verify page says a recipient can check a code by clicking the link in the email, typing it on the Verify page or scanning the QR code, or give the file check a PNG, JPEG, WebP, SVG or PDF to read every seal, QR code and printed code in it. Authentikor's pages say the person checking needs nothing installed and no account; they check the code in a web browser.
If you have already paid or replied
The FBI IC3 2025 Annual Report advises that if you find a fraudulent transfer, time is critical: contact your financial institution immediately to ask for a recall of the funds, and find out what help it will give, because policies differ between institutions. The IC3 report also asks victims to file a complaint with the FBI's IC3, a US reporting channel, with full transaction details, whatever the amount. If you replied with login details, change those passwords at once.
When the next invoice or payment request arrives, start with the check: Check a code, file or website.
Questions and answers
What is business email compromise?
The FBI's Internet Crime Complaint Center defines BEC as a scam aimed at businesses or individuals who work with suppliers or regularly make wire transfer payments, in which fraudsters compromise email accounts and other channels to make unauthorised transfers of funds. The common thread is borrowed trust: the request, not the name on it, is what needs checking.
How does business email compromise work?
It places a payment request inside a conversation that already feels routine. ITWeb gives typical South African patterns: a supplier invoice arrives with new banking details, a 'CEO' tells finance to release an urgent payment, or someone intercepts a law firm's trust account emails and quietly changes the beneficiary details.
How do you prevent business email compromise?
ITWeb says a business limits its BEC liability by writing its payment checks down and applying them every time: confirm any new banking details independently, call back on a number you found yourself, use two-factor authentication on email and banking accounts, and give finance staff a clear internal policy. Courts look at whether that standard was actually applied.
What is the difference between business email compromise and phishing?
The difference is the goal: phishing is after your details, while business email compromise is after a payment. The FBI IC3 2025 Annual Report defines phishing and spoofing as unsolicited messages, supposedly from a legitimate company, that ask for personal, financial or login details.