8 Business Email Compromise (BEC) Script Examples to Know

8 BEC Script Examples to Know

One of the biggest cybersecurity threats facing Northeast Ohio businesses isn’t a high-tech hack– it’s a simple email sitting quietly in your inbox.

Business Email Compromise (BEC) is a social engineering scam where cybercriminals impersonate someone your team trusts — a vendor, coworker, or executive. They might hijack a legitimate email account or create one that looks almost identical. From there, they send convincing messages designed to trick employees into wiring funds, sharing credentials, or revealing sensitive information.

These attacks are more common than most people realize. According to the FBI’s 2024 Internet Crime Report, BEC was the second-costliest type of cybercrime last year, leading to nearly $2.8 billion in reported losses — and that’s only what was officially tracked.

8 Business Email Compromise (BEC) Script Examples

What’s the best defense against Business Email Compromise? Recognizing it before it happens.

Cybercriminals have become masters of persuasion. Their emails often look legitimate — especially when your team is moving fast and juggling priorities. But when employees know what red flags to look for, they can stop these attacks before they ever cause damage.

The examples below show how Business Email Compromise (BEC) schemes typically play out in real workplaces. We recommend sharing these with your finance, HR, and leadership teams — anyone who might handle payments, vendor communications, or sensitive data.

A quick pause to double-check an email or confirm a request could save your organization thousands of dollars– or more.

1. The “CEO Needs a Favor” Scam

Why it works: people want to be helpful, especially when a request looks like it’s coming from the CEO. Cyber criminals exploit that trust by spoofing an executive’s email (or using an address that looks nearly identical) and pairing the request with pressure and secrecy so nobody stops to verify.

2. The “We Changed Banks” Scam

This one’s especially sneaky because it doesn’t ask for money right away– it just sets the trap.

In this version of a Business Email Compromise (BEC) attack, a scammer pretends to be one of your trusted vendors and sends a routine update: “We’ve changed banks. Here are our new payment details.”

Related: 10 Questions To Ask When Evaluating Your Vendor’s Cybersecurity Stance

At first glance, everything seems legitimate. Your finance team updates the vendor profile in your system– no red flags yet. But the next time an invoice comes through, the payment goes straight to the scammer’s account instead of your actual vendor.

The worst part? You might not realize what happened until weeks later, when your real vendor reaches out asking why their payment is late.

3. The “Urgent Legal Matter” Scam

This one preys on fear and formality. Most employees don’t want to get on the wrong side of a legal issue– and cybercriminals know it.

In this scam, the cyber criminal uses attorney impersonation, stating they’re managing a “confidential” matter for your company. The tone is professional, the language sounds official, and the pressure is immediate.

Typically, they target employees who don’t usually work with your company’s legal team. That makes it easier to slip past suspicion and harder for the employee to confirm whether the request is legitimate. The email often warns against discussing the matter with anyone else, discouraging verification and creating a false sense of urgency.

4. The W-2 Data Request Scam

Not every Business Email Compromise (BEC) scam is about wiring money. Some go after something even more valuable– your employees’ personal information.

This scam tends to surface around tax season, when W-2 requests feel routine. The attacker impersonates a senior executive and emails HR asking for a full list of employee W-2s, complete with names, addresses, and Social Security numbers. The email might claim it’s for an audit, a leadership review, or tax preparation.

Because the request looks like it’s coming from someone high up– and because HR teams handle sensitive data every day– it can feel natural to respond quickly without thinking twice. But once that information is sent, the attacker can use it for identity theft, fraudulent tax filings, or sell it on the dark web for future attacks.

The fallout goes beyond your organization– it directly affects every employee whose data was exposed.

5. The “Stranded Executive” Scam

This scam tugs at the heartstrings– and that’s what makes it so effective. The attacker pretends your CEO or another executive is in distress while traveling: they’ve lost their wallet, had a medical emergency, or are stuck without access to funds. The message feels urgent, emotional, and personal– designed to make someone act fast out of concern.

It’s not just about money; it’s about emotion. Cyber criminals know that when employees think a trusted leader is in trouble, their first instinct is to help. Some attackers even follow up with a phone call, using a stressed or panicked tone to increase the pressure and push for an immediate transfer.

6. The “No Time for Questions” Scam

This scam relies on pressure and authority– two things that can make even confident employees hesitate. The attacker impersonates a senior executive and sends a commanding email that leaves no room for questions. The tone is clipped, urgent, and absolute: “I need you to process this wire transfer immediately.”

It’s effective because it triggers a natural response: when someone in leadership gives a direct order, most people want to act quickly and do their job well. The scammer often adds a believable reason why normal approval steps can’t happen– they’re boarding a flight, in a meeting, or dealing with a “confidential” situation. The result? The employee feels like verifying the request would be overstepping.

7. The “You’re My Go-To Person” Scam

Why it works: flattery lowers defenses. When someone in leadership singles you out as “reliable” or “discreet,” it feels good– and that feeling can shortcut normal caution. Scammers use praise to create a sense of personal trust, then follow it with a request that bypasses normal controls.

8. The “Keep This Confidential” Scam

If an email ever asks you to keep a financial request secret, that’s your biggest red flag.

Scammers know that the moment you talk to someone else — a colleague, your manager, or the real executive — the scheme collapses. That’s why they build secrecy into the message itself. The goal is to isolate you and stop you from following your normal approval process.

To make the secrecy sound legitimate, they’ll add a believable backstory– maybe it’s a surprise acquisition, a confidential legal matter, or employee bonuses that haven’t been announced yet. The story gives you a reason to stay quiet, but that’s exactly how they win.

Here’s the truth: legitimate business doesn’t operate in the dark. Real financial procedures rely on transparency and checks to protect everyone involved.