Business email compromise (BEC) is fraud carried out through email: an attacker impersonates someone you trust and persuades you to send money or sensitive information. It rarely involves malware, which is why antivirus alone doesn't stop it. The FBI's Internet Crime Complaint Center consistently reports it among the most costly types of cybercrime.
Common forms of BEC
- Fake vendor invoices: a supplier appears to send updated bank details, and the next payment goes to the attacker.
- Executive impersonation: someone posing as the owner asks an employee to send a wire transfer or buy gift cards urgently.
- Real estate and settlement fraud: closing instructions are altered just before funds are sent.
- Payroll diversion: an employee appears to ask HR to change their direct deposit account.
How attackers get in
Some attacks use lookalike domains, such as a company name with one letter changed, or a display name that matches your boss. More damaging attacks use a real mailbox that has been taken over, usually through a phishing page that captured a password.
Once inside a mailbox, attackers often read past conversations to learn who pays whom, then create inbox rules that hide replies or forward messages so the real owner doesn't notice. The fraudulent request then arrives from a genuine address, in an existing thread, at the right moment.
Technical controls that help
- Multi-factor authentication on every mailbox, which stops most account takeovers that start with a stolen password.
- Email filtering with impersonation protection, which flags lookalike domains and display-name spoofing.
- External sender warnings that mark messages from outside your organization.
- SPF, DKIM, and DMARC at enforcement, which makes it harder to send email that appears to come from your exact domain.
- Blocking external auto-forwarding and alerting on new inbox rules, which exposes compromised mailboxes sooner.
Process controls matter just as much
The most effective defense is a simple rule: any change to payment instructions is confirmed by phone, using a number you already have on file, never one provided in the email. Add a second approval for large or unusual payments, and make sure staff know they won't get in trouble for slowing down a suspicious request.
If it happens
Contact your bank immediately, since a fast recall request is the best chance of recovering funds. Then reset the affected account's password, revoke its active sessions, remove any unfamiliar inbox rules or forwarding, review sign-in history, and report the incident to the FBI's IC3. Notify your cyber insurer early, as policies often have specific reporting requirements.
Founder of Albano Tech, providing managed IT, Microsoft 365, and cybersecurity services to businesses in Delaware, Maryland, and the Philadelphia region. More about Zach.
Need help with this?
Albano Tech provides Cybersecurity & Security Assessments for businesses in Delaware, Maryland, and the Philadelphia region.