Business Email Compromise: How BEC Scams Work and How to Stop Them

Business email compromise, or BEC, is a fraud in which criminals impersonate an executive, supplier or colleague by email to trick staff into sending money or sensitive data. It succeeds through trust and urgency rather than technology, so clear verification rules are the strongest defense.

What makes BEC different from ordinary phishing

Typical phishing casts a wide net with generic messages. BEC is targeted and patient. Attackers research an organization, learn who approves payments, and study how people write to one another. Messages often contain no malicious links or attachments at all, just a plain, believable request, which lets them pass many automated filters.

The attacker either spoofs an address that looks almost identical to a real one, or compromises a genuine mailbox and sends from it. The second type is far harder to detect because the message really does come from a legitimate account.

Common BEC scenarios

• Fake executive request. A message that appears to come from a senior leader asks an employee to make an urgent, confidential payment or buy gift cards.
• Supplier bank change. A “supplier” announces new bank details for future invoices.
• Payroll diversion. An “employee” asks HR to change direct-deposit details.
• Invoice interception. An attacker inside a mailbox alters a real invoice mid-conversation.
• Data requests. A “manager” requests lists of employees or customer records, which are used in later attacks.
• Legal or acquisition pretext. A confidential deal that requires speed and secrecy.

Warning signs for staff

• A request that bypasses normal procedures or asks you to keep it quiet.
• Strong urgency, especially when the sender is unavailable by phone.
• A subtle change in the email address, domain or writing style.
• A reply-to address that differs from the sender.
• New or changed bank details with no prior notice.
• A payment amount or timing that is unusual for that relationship.

Controls that reduce risk

1. Call-back verification. Confirm any new or changed payment details by phoning a known number, not one in the email.
2. Dual approval. Require two people to authorize payments above a set threshold or to bank detail changes.
3. Multi-factor authentication on all mailboxes, to reduce the chance of takeover.
4. External sender labels and warnings for lookalike domains.
5. Rules against forwarding email to outside accounts, and alerts for new inbox rules.
6. Clear procedures for urgent exceptions, so staff know the path to follow.
7. Regular, practical training using realistic examples.

Protecting your own mailbox

Attackers who take over a mailbox often create hidden rules to forward or delete messages, then watch for payment conversations. Check mail rules and forwarding settings regularly, review sign-in activity, and use strong, unique passwords. Limit what you publish about roles, travel schedules and approvals on social media, since those details help attackers design convincing requests.

If a fraudulent payment was made

Time matters most. Inform your bank immediately and ask whether the transfer can be recalled or frozen. Notify your IT or security contact, preserve the emails with full headers, secure the affected mailboxes and reset passwords. Report the incident to the appropriate authorities, tell the genuine supplier or executive whose identity was used, and review procedures to find which control failed. Honest, blame-free reviews help organizations improve.

A step-by-step example of an invoice interception

Imagine a small company that regularly pays a supplier. An attacker gains access to the supplier’s mailbox, perhaps through a stolen password, and quietly reads the conversations. When the next invoice is due, the attacker sends a message in the same thread, with the same tone and a similar attachment, stating that the bank account has changed. The accounts clerk sees a familiar name and a familiar thread, updates the details and pays. The supplier never receives the money, and the problem emerges only when they chase the overdue invoice.

Nothing in this story involves a suspicious link or attachment, which is why technical filters often miss it. What would have stopped it is a rule that any change of bank details is confirmed by a phone call to a number already on file, plus a second person reviewing the change.

Building the habit

1. Publish a one-page payment procedure that says how new suppliers and bank changes are verified.
2. Make exceptions hard: urgent requests follow the same steps as any other.
3. Keep a verified contact list for suppliers and leaders, stored separately from email.
4. Run short drills in which staff practice responding to a mock urgent request.
5. Celebrate people who pause and check, even when the request turns out to be genuine.

The aim is to make verification a normal part of the workflow, so staff are never put in the position of choosing between helping a senior person quickly and following the rules.

Frequently asked questions

Why is BEC so costly?

Because payments are often large and transfers are hard to reverse. A single successful request can matter more than hundreds of ordinary scam attempts.

Can small businesses be targets?

Yes. Small organizations may have fewer controls and one person handling payments, which makes them attractive.

Is email filtering enough?

No. Many BEC messages contain no malicious content. Procedures and verification are essential.

Key takeaways

• BEC relies on trust, authority and urgency, not malware.
• Verify payment and bank detail changes by phone with a known number.
• Use dual approval and multi-factor authentication on mailboxes.
• If money was sent, contact your bank immediately and report.