Business Email Compromise (BEC)

Business email compromise (BEC) is a category of fraud in which a criminal either gains unauthorised access to a genuine business email account or creates a highly convincing imitation of one, then uses it to deceive staff, customers, or suppliers into transferring money or sensitive data. It is consistently ranked as one of the highest-value fraud types targeting organisations of every size.

BEC covers a spectrum of attack types. At one end, a criminal phishes an employee's email credentials, logs into their account, and uses it to send fraudulent payment instructions to the finance team — from an address that is entirely real. At the other end, a criminal registers a look-alike domain (e.g. replacing a letter with a similar character, or adding a word like 'accounts' or 'finance') and sends correspondence designed to be mistaken for a legitimate internal or supplier email.

Between these poles lie man-in-the-middle attacks, where the criminal monitors a real compromised email account without the victim's knowledge, waits for an active payment conversation, and then injects fraudulent banking details at a precisely chosen moment. Because the surrounding conversation is genuine, the tampered instruction is extraordinarily difficult to detect.

The financial impact of a single BEC incident can be severe — ranging from thousands to millions, depending on the organisation's payment volumes. Unlike card fraud, bank transfers are difficult to reverse, and recovery is far from guaranteed.

Most BEC attacks begin with credential theft. A phishing email, a credential-stuffing attack against a reused password, or malware installed through a malicious attachment gives the attacker access to a genuine business email account. Rather than acting immediately, the attacker often spends time silently monitoring the inbox — reading ongoing conversations, understanding supplier relationships, payment processes, and the language and sign-off conventions used by legitimate staff.

When a suitable opportunity arises — an active supplier payment conversation, a pending property transaction, a payroll run — the attacker acts. They may send a message directly from the compromised account changing payment details; insert fraudulent banking information into an ongoing thread; or use the intelligence gathered to send a convincing spoofed email from a look-alike domain at exactly the right moment.

In parallel, some BEC attacks focus on data rather than money: using a compromised HR or payroll email to redirect salary payments, or extracting sensitive company or personal data for use in subsequent attacks. Others combine payment diversion with data theft in coordinated campaigns targeting multiple contacts in the same organisation.

BEC is effective for a fundamental reason: it attacks the identity layer of business communication. When an email appears to come from a known colleague, a trusted supplier, or a senior executive — whether via a compromised real account or a convincing look-alike — recipients apply a level of trust that bypasses normal scepticism.

The fraud also exploits the speed and volume of modern email-based business. Finance teams process large numbers of payment instructions daily; verifying each one via an independent channel would be operationally impractical without a structured control framework. BEC thrives in the gap between the trust placed in email identity and the effort required to verify it.

For compromised-account attacks in particular, detection is genuinely difficult. The email address is correct, the thread is real, the writing style may match, and the only evidence of fraud is a small change to bank account details embedded in an otherwise normal exchange.

A supplier's email account is compromised following a phishing attack. The attacker monitors correspondence for several weeks and identifies that a significant invoice payment is expected. Shortly before the payment run, the attacker sends an email from the real supplier address explaining that a bank account has changed, providing new details. The finance team, dealing with a familiar supplier via a real email address, updates the payment details. The payment is processed to the fraudster's account. The real supplier follows up on the unpaid invoice and the fraud is discovered.

Please update the payment for invoice [invoice number] ([amount]) to our new account details below. Our previous account is no longer active.

(Appearing to come from an internal finance address) Hi [name], please process payment of [amount] to the revised account below as discussed with [colleague name].

Our bank has recently changed. Please make sure all pending payments — including [invoice number] — go to the new details. I've updated the invoice and attached it here.

This is [supplier contact]. There's been an urgent change to our account — please use these details for the payment due this week. The old account is frozen.

Hi, I'm messaging from [company] accounts. Please send the remittance for [invoice number] to [new account]. Please discard the previous bank details.

(Sent from a look-alike domain) Following up on the payment for [invoice number]. Please note our account details have changed as below.

Defending against BEC requires controls at both the technical and procedural levels:

Technical controls: - Enable multi-factor authentication (MFA/2FA) on all business email accounts using an authenticator app rather than SMS. This prevents credential theft from leading to account access. - Configure email authentication protocols (SPF, DKIM, DMARC) to reject or flag emails from spoofed or look-alike versions of your domain. - Enable login alerts on email accounts so that unusual access attempts are flagged immediately. - Consider email gateway tools that flag first-time-sender domains or external emails mimicking internal addresses.

Procedural controls: - Mandate an out-of-band callback — using a phone number from your own records — for any payment instruction that changes banking details or involves an unusual request. - Apply dual authorisation for all payments above a threshold. - Brief staff to slow down when urgency and secrecy accompany a payment change — these are consistent BEC signals.