What is business email compromise and how do I prevent it?

Business email compromise (BEC) is a targeted fraud where an attacker either hacks a corporate email account or registers a look-alike domain to send emails appearing to come from a senior executive, trusted vendor, or attorney. The email instructs an employee in finance or accounts payable to make an urgent wire transfer, change vendor banking details, or release payroll to a new account. The FBI considers BEC one of the costliest cybercrime categories, with multi-billion dollar annual losses across organisations of all sizes.

The attack relies on several conditions: employees who are conditioned to act quickly on senior requests, insufficient controls around payment authorisation, and email systems that do not clearly flag external look-alike domains. Attackers research their targets before striking — studying the corporate hierarchy from LinkedIn, learning financial reporting periods (when large transfers are common and less scrutinised), and identifying employees with payment authority.

The most effective single control is a verbal confirmation rule: any wire transfer, any change in vendor banking details, and any payroll modification requires a call to the requester on a number from your own contact list — not a number provided in the email. This one step defeats the vast majority of BEC attacks because the attacker cannot answer the phone as the real executive. Combine this with dual-approval thresholds so no single employee can authorise large transfers without a second signatory.

Technical controls complement the human process: enable multi-factor authentication on all corporate email accounts, configure email systems to tag messages from external domains that mimic internal addresses, and deploy DMARC email authentication to prevent attackers from spoofing your exact domain in messages to external parties.