Your Mac will not save you from business email compromise. There's no malware to catch and no bad attachment to quarantine. A BEC scam is just a convincing email that talks one of your people into wiring money or handing over data, and macOS has no filter for a request that looks completely normal.
These scams have been around for years, but AI tools have made them sharper. Criminals use AI to clean up the writing, mimic a real person's tone, and target the right employee. The losses are big and growing. BEC cost businesses $6.7 billion worldwide in 2023, and Perception Point found a 42% jump in incidents in the first half of 2024 over the same stretch in 2023. Running Macs does not put you outside that trend.
What a BEC attack actually is
BEC is not the spray-and-pray phishing you're used to. It's a targeted attack. A criminal gets into or impersonates an email account, then uses it to talk an employee, partner, or client into sending money or sensitive information. The whole con runs on trust, not code. There's nothing for macOS to scan, because the message itself looks like it came from someone you know.
That's what makes it work. When an email appears to come from your CEO or a vendor you pay every month, people act on it. They're not being careless. They're trusting a name they recognize.
What it costs you when it works
- Money you won't get back. One convincing email can trigger an unauthorized payment or hand over data. The average loss tops $137,000 per attack, and once the funds move, recovering them is close to impossible.
- Days of cleanup. A successful scam means downtime, audits, and a scramble to figure out what else got touched while normal work stops.
- A hard call with your clients. Explaining that a hijacked email exposed a client's data is a conversation that damages the relationship and your reputation.
- Shaken confidence inside the team. People who assumed their Mac kept them safe learn the hard way that it doesn't, and that rattles them.
The forms these scams take
- Fake invoices. A criminal poses as a vendor you trust and sends a bill that looks like every other one you've paid them.
- CEO fraud. A message that looks like it's from an executive pressures an employee to move money fast, before there's time to think.
- A real account, hijacked. The attacker takes over a legitimate inbox and sends the malicious request from inside it, so nothing looks off.
- Vendor impersonation. Requests appear to come from a third party you work with, sent from a spoofed or compromised account.
How to stop BEC at a Mac shop
BEC is preventable. None of it requires fancy software. It requires a few habits and one firm rule about money.
- Train your team to be suspicious.
- Show people what a phishing email looks like and what an urgent money request feels like. Make verbal confirmation the policy for any payment or sensitive transaction, no exceptions.
- Turn on multifactor authentication.
- MFA keeps a stolen password from being enough to break in. Enable it on every account, starting with email and financial platforms, on every Mac your team uses.
- Test that your backups actually restore.
- A backup you've never restored is a guess. Restore from it on a regular schedule so you know it works before an attack is the moment you find out it doesn't.
- Tighten email and access.
- Run email filters built to catch malicious links and attachments on Mac systems. Review who has access to what, and cut off former employees the day they leave.
- Verify money over a second channel.
- Before you send a large payment or act on a sensitive financial request, confirm it by phone with the person who supposedly asked. This one step stops most BEC attacks cold.
Where to start
The scams keep getting better, but the defense hasn't changed much. Train your people, lock down your Mac accounts with MFA, and verify every money request by phone. Do those three things and a slick email stops being enough to drain your account.