Key takeaways
- Business email compromise tricks people into sending money or data, often with no malware at all.
- The strongest defence is a payment process that always verifies changes through a second channel.
- Technical controls, such as multi-factor authentication and email authentication records, reduce the chances of it starting.
What it is
Business email compromise, often shortened to BEC, is fraud carried out through email. An attacker either takes over a real mailbox or pretends to be someone you trust, such as a senior leader, a supplier or a customer, and asks for a payment, a change of bank details or sensitive information. Because the messages look ordinary and contain no virus, many security tools miss them.
Common forms
- Fake invoices or bank detail changes from a supplier whose mailbox has been hacked or spoofed.
- Executive impersonation asking finance for an urgent payment or gift cards.
- Payroll diversion where someone pretending to be an employee asks to change their bank account.
- Data requests for staff records, tax forms or customer lists.
- Conversation hijacking where the attacker joins a real email thread and inserts new payment details at the right moment.
Warning signs to teach
- Urgency, secrecy or a request to bypass the normal process.
- A change of bank details, especially close to a payment date.
- A sender address or domain that is slightly different, or a reply-to address that does not match.
- A request to move the conversation to personal email or messaging apps.
- Tone or timing that feels slightly off for that person.
The process that stops it
- 1Confirm every bank detail change by phone, using a number you already hold, never one from the message.
- 2Require two people to approve payments above a set amount and any new payee.
- 3Hold a short delay on first payments to a new account.
- 4Make it safe to question a request from a senior leader. Say so in policy.
- 5Report immediately. If a payment was made, contact your bank straight away, because speed can allow recall.
Technical controls
- Multi-factor authentication on every mailbox, so stolen passwords are not enough.
- Email authentication records (SPF, DKIM and DMARC) so others cannot easily pretend to be your domain.
- Filtering that flags lookalike domains and first-time senders.
- Alerts for unusual mailbox rules, such as automatic forwarding to outside addresses.
- Monitoring of sign-ins from unexpected places, which threat detection can raise in minutes.
Training and practice
Run short, realistic exercises for the finance and payroll teams and for assistants who work with senior leaders. Our awareness and reporting service covers training, simulations and an easy reporting button. For the technical side, see ten security controls every small business needs.
Further reading
Independent sources we recommend for more detail.