Business email compromise (BEC) is a scam where a criminal uses a real or lookalike email account to talk staff into sending money or data to the wrong place. There is no malware, so filters rarely catch it. You stop it with MFA, mailbox-rule alerts, email authentication and a rule that no banking change happens over email alone.
How does a business email compromise attack work?
It works in stages, and the patience is the point. A BEC crew may sit inside a mailbox for weeks before asking for anything.
- Reconnaissance. The attacker reads your website, LinkedIn and state business filings to learn who owns the company, who runs accounts payable, who the bookkeeper is and which vendors you name publicly.
- Getting a mailbox. Two routes. The cheap one is a lookalike domain: yourcompany-inc.com instead of yourcompany.com, or an "rn" where an "m" should be. The better one is your actual mailbox, taken with a phished password and, increasingly, a phished session cookie that walks past weaker MFA.
- Inbox rules that hide the replies. Once inside, the attacker creates rules so the owner never sees the conversation: move anything mentioning "invoice" or "wire" to an obscure folder, mark it read, delete replies from the bank. Often they add a forwarding rule to an outside address so they keep reading after the password is changed.
- Waiting for the moment. They watch for an invoice cycle, a real estate closing, a payroll run or a trip when the owner will be hard to reach.
- The ask. It arrives as a plausible message in a real thread: the owner needs an urgent wire for a deal closing today; an employee has changed banks and wants direct deposit updated; the attorney needs the closing funds sent to a "new" trust account. Urgency and secrecy are the tells.
- The vendor-invoice variant. The compromised mailbox is often not yours. A supplier's account is taken over, and their real invoice arrives on schedule with one change, the remittance bank details. Your accounts payable team pays the invoice they expected, to an account they did not.
The money lands in a mule account and is moved on within hours. That is why the response steps below are about speed.
Why does BEC get past spam filters?
Because, to a filter, it is a normal email. There is usually no attachment and often no link. It comes from a real mailbox with valid SPF and DKIM, or from a freshly registered domain with no bad reputation yet. It is sent once, to one person, in ordinary language. Filters are built to catch volume, malware and known-bad senders; BEC has none of those. This is a people-and-process attack, which is why the defenses that work are a mix of identity controls and payment procedures rather than a better filter.
How much damage does it do?
The FBI's Internet Crime Complaint Center publishes an annual internet crime report, and year after year business email compromise sits among the costliest crime types in it by reported losses. The reports are worth reading for the current figures and the industry breakdowns. The FTC's small business cybersecurity guidance lists "business email imposters" alongside phishing and ransomware as the attacks it sees hitting small firms, and its advice is blunt: require employees to call and confirm wire transfer requests that arrive by email.
Which controls actually stop business email compromise?
Four groups: keep the mailbox yours, make your domain hard to fake, make the money hard to move, and teach people what the ask looks like.
Keep the mailbox yours
- MFA on every account, enforced by policy, with phishing-resistant methods (passkeys or hardware keys) for finance staff, executives and admins, since a plain code can be relayed by a fake login page.
- Conditional access. Block sign-ins from countries you do not operate in, require a managed device for email, and flag impossible travel.
- Disable legacy authentication. Old protocols such as IMAP, POP and basic SMTP authentication skip MFA entirely. Turn them off tenant-wide and fix the one scanner that needed them.
- Block or alert on auto-forwarding and new inbox rules. Disable external auto-forward at the tenant level and alert on any rule that deletes, moves or forwards mail. Rule creation is the earliest reliable sign of a compromised mailbox.
- Watch the identity, not just the endpoint. Identity monitoring, whether from Microsoft's own tools or a service such as Huntress, catches the foreign sign-in and the rogue rule while the attacker is still reading. That detection is the job of managed detection and response.
Make your domain hard to fake
- SPF, DKIM and DMARC on your domain, with DMARC moved to a reject policy once every legitimate sender is accounted for. This stops exact spoofs of your domain reaching customers and vendors; it does nothing against lookalike domains or a compromised account, which is why it is one control among several.
- External sender tagging, so an email from a lookalike domain carries a visible banner even when the display name says "Owner."
- Registering the obvious lookalikes of your own domain is cheap and removes the easiest version of the attack.
The filtering, authentication and impersonation protection sit under email security; the point is that they are necessary and not sufficient.
Make the money hard to move
- Out-of-band verification for every banking change. Any request to change a vendor's bank account, an employee's direct deposit or a wire destination is confirmed by phone, using a number you already had on file, never one in the email. No exceptions for the owner, the attorney or the vendor you have used for ten years.
- Dual approval on payments above a threshold you set, with the second approver looking at the bank details, not just the amount.
- Vendor master changes through a form owned by one person, with the callback logged, so a change cannot be slipped in by replying to a thread.
- Payroll changes confirmed in person or through the HR system, never from an email request.
Teach people what the ask looks like
The person who receives the email decides the outcome, so they need to have seen the pattern before. CISA's Secure Our World program puts recognizing and reporting phishing first among its four basic steps, and that is the right emphasis: a report that reaches IT in minutes limits the damage. Short, regular security awareness training with real BEC examples, plus a no-blame rule for reporting, beats an annual slideshow.
What should you do in the first hour after you discover a BEC?
- Call your bank first. If money has moved, ask for a recall and a hold on the receiving account, immediately. Recalls succeed when they are fast, and the odds drop as the funds are moved on.
- File a report at IC3. Report at ic3.gov with the transaction details. The FBI works with banks on freezing fraudulent transfers, and a prompt report gives that process a chance. Keep the complaint number for your insurer.
- Lock the mailbox. Reset the password, revoke all active sessions, remove every inbox rule and forwarding address, review registered MFA methods for one the attacker added, and check for third-party app consents. If you are not sure which mailbox was the source, do this for everyone in the thread.
- Preserve the evidence. Do not delete the emails. Export the messages with full headers, the sign-in logs, the audit log and the inbox rules as they were. Your insurer, your bank and law enforcement will all want them.
- Call the other party. If a vendor's or customer's mailbox was the one compromised, they are about to hit other companies. Tell them by phone.
- Notify your insurer and counsel. Cyber policies have notification clauses with short windows, and if the mailbox held customer or employee data, counsel needs to assess notification duties.
- Check who else got the same email. One BEC attempt usually means others, to other staff or to other targets using your name.
Red flags versus the right response
| Red flag | The right response |
|---|---|
| A vendor emails new bank details for payment | Call the vendor on the number already on file. Pay nothing until they confirm by voice. |
| The owner asks for an urgent wire and says they cannot talk | Call them anyway. The policy says every wire is confirmed by voice, including theirs. |
| The reply is in the right thread but the sender's domain is slightly off | Check the actual address, not the display name. Treat the thread as compromised. |
| An employee emails a direct deposit change | Confirm in person or through the HR portal. Never update from an email. |
| A real invoice arrives from a personal webmail address | Treat it as a new vendor and verify through your existing contact. |
| A colleague's replies to you have stopped arriving | Check their inbox rules and sign-in history before anything else. |
| Pressure to keep the payment confidential | Secrecy is the tell. Escalate to a second person immediately. |
Frequently asked questions
Is business email compromise the same as phishing?
Phishing is usually the way in; BEC is what the attacker does once they have a mailbox or a convincing fake of one. Many BEC attacks start with a phished password, but the scam itself is a targeted request for money or data that often contains no link at all.
Will cyber insurance cover a BEC loss?
Sometimes, and often with a lower sublimit than the headline policy limit, under terms such as "social engineering" or "funds transfer fraud." Policies frequently require that you had verification procedures and MFA in place. Read the policy before you need it, and keep evidence of the controls.
Does DMARC stop business email compromise?
It stops exact spoofing of your domain, which is one of several variants. It does nothing against lookalike domains, personal webmail accounts or a compromised real mailbox, so it belongs alongside MFA, rule alerts and payment verification rather than instead of them.
We are a small company. Why would anyone target us?
Because small companies pay invoices and wires with fewer approvals, and because your vendor or customer may be the one who was compromised. BEC crews work lists, not reputations, and the ask is sized to what your bank will clear.
What if the compromised mailbox belonged to our vendor, not us?
You can still lose the money, and your bank will still treat the payment as authorized by you. The vendor callback rule exists for exactly this case: the invoice was real, the sender was real, and only the bank details changed.