Key Takeaways
- Phishing casts a wide net, spear phishing targets specific people, and BEC goes after your money.
- BEC emails often have no links or attachments, which is why filters miss them.
- Reported BEC losses hit about $3 billion in 2025, according to the FBI.
- A quick callback before any banking change or wire stops most BEC scams.
- Multifactor authentication, DMARC, and regular training work best together.
- Ongoing monitoring catches compromised mailboxes before damage spreads.
Your accounts payable person gets an email from the CEO on a Friday afternoon. It’s short. “Need a wire sent today for a vendor, I’m in meetings, just handle it.” The name looks right. The tone sounds right. The money is gone by Monday.
It’s one of the most common ways small businesses lose money, and no malware is involved.
Most owners have heard the word phishing. Fewer know that phishing, spear phishing, and business email compromise (BEC) are three different attacks, with different targets and very different price tags. Understanding phishing vs spear phishing vs BEC makes it much easier to train your team and pick the right protection.
What Is Phishing?
Phishing is the wide net. Attackers send the same message to thousands of people and wait for a few to bite. You’ve seen these: a fake package delivery notice, a “your Microsoft 365 password expires today” warning, or an invoice from a company you’ve never done business with.
The goal is usually one of two things. Either you click a link and type your password into a fake login page, or you open an attachment that installs malware.
Generic phishing is sloppy by design. The attacker only needs a few people to fall for it. Still, it works. Phishing remains one of the top ways attackers get their first foothold, and it’s a big part of the broader cyber threat landscape facing businesses today.
What Is Spear Phishing?
Spear phishing is phishing with homework.
Instead of blasting a million inboxes, the attacker picks a specific person or small group. They study LinkedIn, your website, and social media, then write a message that feels personal.
A spear phishing email might mention your real vendor by name, reference a project you’re actually working on, or appear to come from a coworker. Even careful employees get fooled, which is why the success rate is so much higher.
Office managers, finance staff, HR teams, and executive assistants are frequent targets. They have access to money, payroll data, or the boss’s inbox.
What Is Business Email Compromise (BEC)?
BEC is where the real money disappears.
In a business email compromise attack, the criminal impersonates someone you trust and asks for a payment or sensitive information. Sometimes they spoof an email address that looks almost identical to the real one. Other times they’ve already broken into a real email account, often through an earlier phishing attack, and they’re sending messages from inside it.
Common BEC scams include fake requests to change a vendor’s bank account details, urgent wire transfers “approved” by the CEO, payroll diversion requests asking HR to update an employee’s direct deposit, and gift card requests from a “manager” who’s too busy to call.
There’s often no link and no attachment. Just a believable request. That’s why spam filters miss so many of them.
The numbers are hard to ignore. According to the FBI’s Internet Crime Complaint Center, reported BEC losses reached roughly $3 billion in 2025 alone, making it one of the costliest types of cybercrime in the country. And that’s only what got reported.
Quick Comparison
Warning Signs Your Team Should Know
Train people to slow down when an email asks them to act fast. Urgency is the attacker’s favorite tool.
Watch for sender addresses that are slightly off, like a missing letter or a different domain ending. Be suspicious of any request to change bank details, send a wire, or buy gift cards, even if it comes from the boss. And if something feels a little unusual, it probably deserves a phone call.
How to Protect Your Business
No single tool stops all three attacks, so you need layers.
Start with people. Run regular security awareness training and simulated phishing tests, so employees practice spotting fakes in a safe setting. Make it easy and blame free to report a suspicious email.
Next, lock down email. Turn on multifactor authentication for every account, especially Microsoft 365 and Google Workspace. Set up SPF, DKIM, and DMARC records so criminals have a harder time spoofing your domain. Advanced email filtering adds another layer, and solid cloud security settings close gaps attackers love to exploit.
Then fix your payment process. This one is simple and powerful. Require a verbal callback, using a phone number you already have on file, before changing any vendor’s banking details or sending a large wire. That single habit stops most BEC scams cold.
Finally, have someone watching. Many small businesses don’t have time to monitor email activity or investigate alerts. That’s where managed security services for SMBs make a real difference, catching suspicious logins and mailbox rule changes before money moves.
How CyberShield IT Helps
CyberShield IT has protected businesses since 1996, and email fraud is one of the problems we see most often across the Tampa Bay area.
Our managed IT services include email security setup, multifactor authentication rollout, DMARC configuration, and ongoing monitoring. We also run phishing simulations and employee training that people actually remember. Because we look after your network and compliance needs too, we can show you how managed IT services keep your data secure and compliant without piling more work on your team.
If you’d like to see where your business stands, our team offers a full range of cybersecurity services in Tampa, starting with a straightforward email security review.
