Business email compromise: how it works and how to stop it

What is business email compromise

Business email compromise is a type of cybercrime where an attacker gains access to a business email account and impersonates the owner's identity. The goal is usually to defraud the company, its customers, or its partners. Unlike traditional phishing, BEC is highly targeted and often involves long-term monitoring of conversations. This monitoring allows the attacker to learn the language, tone, and specific procedures of the business, making their eventual fraud much harder to detect.

The FBI reports that business email compromise results in billions of dollars in losses every year. It is a major threat to small and mid-sized businesses because these organizations often have fewer formal controls for verifying large financial transactions. Because BEC attacks don't always use malicious links or attachments, they often pass through standard email security filters unnoticed. The attack relies on the trust we place in our professional communications.

In many cases, the attacker isn't even 'hacking' in the traditional sense. They might be using a spoofed domain that looks almost identical to yours, or they might have purchased stolen credentials from a dark web forum. Once they have a way in, they are patient. They will wait for the perfect moment—such as a large project closing or an annual contract renewal—to strike.

How a BEC attack unfolds

A typical business email compromise attack follows a specific lifecycle. It rarely happens all at once. The attacker takes their time to ensure the scam succeeds and that the money is transferred before anyone notices.

1. Identification: The attacker identifies a target, often someone in finance, payroll, or a senior executive with payment authority.
2. Gaining Access: The attacker uses phishing, stolen credentials, or social engineering to log into the employee's email account.
3. Reconnaissance: The attacker reads emails, studies invoice templates, and watches how the company handles wire transfers and payments.
4. Setting the Trap: The attacker may set up 'auto-forwarding' rules so they receive copies of all incoming mail without the user knowing.
5. The Lure: The attacker sends a message from the real account (or a very similar one) requesting a change in payment details.
6. The Transaction: The victim sends money to the attacker's account, thinking they are paying a legitimate vendor or colleague.

During the reconnaissance phase, attackers are looking for specific details. They want to know who the authorized signers are, what the internal approval process looks like, and which vendors are paid most frequently. They might even join existing email threads to make their fraudulent request seem like a natural part of the conversation.

Common BEC scenarios

There are several ways business email compromise manifests in a professional setting. Recognizing these patterns helps employees stay alert to requests that seem unusual or out of character.

• The False Invoice: An attacker impersonates a supplier and asks to update the bank account for future payments due to an 'audit' or 'change in banks.'
• CEO Fraud: The attacker impersonates a high-level executive and requests an 'urgent' and 'confidential' wire transfer for a secret acquisition.
• Attorney Impersonation: The attacker pretends to be a lawyer handling a sensitive matter and requests immediate funds to prevent a legal issue.
• Data Theft: Instead of money, the attacker asks for W-2 forms or other sensitive employee data to use in identity theft scams.
• Real Estate Fraud: The attacker intercepts a home purchase transaction and provides fraudulent wiring instructions to the buyer or title company.

Why BEC is so successful

Business email compromise succeeds because it exploits trust and standard business workflows. If an email comes from your boss's actual account, you are likely to follow the instructions. Attackers also use timing, sending requests late on Friday afternoons or right before a holiday when people are rushing to finish their work and are less likely to follow strict verification steps.

Furthermore, the rise of remote work has made BEC easier. In an office, you might walk down the hall to confirm a request. In a remote or hybrid environment, we rely almost entirely on digital communication, which an attacker can manipulate. The lack of face-to-face interaction reduces the chances of an employee spotting a red flag.

Protecting your business from BEC

Preventing business email compromise requires a combination of technical settings and clear internal policies. You cannot rely on technology alone to stop these attacks because they target the person, not just the machine.

• Enable Multi-Factor Authentication (MFA) on all email accounts to prevent unauthorized access even if passwords are stolen.
• Set up 'External Email' banners to highlight messages coming from outside your organization, which helps spot 'look-alike' domains.
• Require 'out-of-band' verification for any change in payment instructions. This means calling the person on a known number you already have on file.
• Train employees to look for subtle signs, like a change in the tone of an email, unusual grammar, or requests for extreme secrecy.
• Implement DMARC, SPF, and DKIM records to prevent attackers from spoofing your own business domain.

It is also helpful to have a two-person approval process for all financial transactions over a certain dollar amount. When two people have to sign off on a wire transfer, the chances of one person catching a fraudulent request increase significantly. Security is a team effort, and shared responsibility is a strong defense.

What to do if a BEC attack succeeds

If you discover that a fraudulent transfer has been made, time is of the essence. The 'financial kill chain' only stays open for a short window, usually 24 to 72 hours. You should immediately contact your bank to request a recall of the funds. You should also report the incident to the FBI's IC3 and your local law enforcement agency.

After the immediate crisis is handled, you must conduct a thorough review of your email systems. If an attacker had access to a mailbox, they might have set up hidden rules to forward mail or changed security settings. Changing passwords and resetting MFA tokens is a mandatory next step to ensure the attacker is completely removed from your network.