Technology Advisor Blog

Imagine three small businesses facing the exact same cyber threat.

An attacker gets access to an employee’s email account. Maybe a password was stolen through phishing. Maybe the attacker found credentials from an earlier breach. However they got in, they now have something incredibly valuable: access to a real business email account.

From there, they can quietly watch.

They can learn who handles invoices. Who approves payments. Which vendors the company works with. How the owner communicates. They may even watch an existing email conversation and wait for exactly the right moment to step in.

This is Business Email Compromise, or BEC. And it’s one of the most financially damaging forms of cybercrime facing businesses today.

According to the FBI’s 2025 Internet Crime Complaint Center (IC3) Annual Report, Business Email Compromise was the second-highest crime type by reported financial losses, behind investment fraud. Businesses and individuals reported approximately $3.05 billion in BEC losses in 2025 from 24,768 complaints.  Read the full FBI report here.

That’s billion with a “B.”

But statistics don’t always make cyber risk feel real.

So let’s look at what happens when the same kind of threat hits three different businesses.

Read More

Not long ago, a scam email was easy to spot. Poor grammar, generic greetings, or suspicious links that looked nothing like the brand they were pretending to be. Most people learned to recognize them and felt reasonably confident in their ability to delete them before any damage was done, but that confidence is now a liability.

Phishing emails in 2026 are professionally written, visually convincing, and increasingly personalized. They reference your name, your company, your colleagues, and sometimes details about your business that feel like they could only come from someone who knows you. They arrive from addresses that look almost identical to the real thing, and create urgency that makes you want to act before you think.

 In a recent workshop hosted by Ekaru, Ann Westerheim and Linda joined Lincoln Vierhus to break down exactly how Business Email Compromise and phishing attacks work and why they are so effective against small businesses in greater Boston. You can watch the full workshop here. 

One of the clearest takeaways from that conversation was this: the emails that cause the most damage are not the obvious ones, but the ones that look completely legitimate right up until the moment they are not.

So how do you actually tell the difference?

Read More

Business email compromise, or BEC, is not always about a suspicious email. Sometimes the real danger is an attacker quietly using a real account while your business has no idea. 

When most people think about email security, they picture a suspicious message landing in someone’s inbox. Maybe it has a strange link, awkward wording, or a request that feels just a little off.

That is still a very real problem. But some of the most damaging email-related attacks do not start with an obviously fake message. They start when a criminal gets access to a real Microsoft 365 account and begins quietly looking around.

That is what makes business email compromise so dangerous.

Read More