Business Email Compromise (BEC)

How it works

BEC attacks fall into a small number of recurring patterns. CEO fraud (sometimes called whaling) impersonates a senior executive — often the CEO or CFO — and sends an urgent payment request to a finance team member, exploiting authority and time pressure. Vendor email compromise impersonates a known supplier, often after the attacker has compromised the supplier's actual email account, and sends invoices with redirected bank details. Account compromise takes over a legitimate internal mailbox and sends fraudulent messages from inside the organisation, bypassing perimeter defences entirely. Attorney impersonation exploits trust in legal counsel during M&A or legal disputes.

Two technical defences materially reduce BEC risk: enforcing DMARC on your own outbound mail (so external attackers cannot spoof your executives to your customers and partners), and applying inbound authentication policies that reject unaligned mail claiming to be from your own domain. But BEC also has a substantial human element — most successful attacks succeed not because authentication failed, but because the recipient believed the message and acted on it. Process controls (out-of-band verification of payment changes, dual approval for unusual transfers) are as important as the email layer.

Example