Business email compromise (BEC)

Business email compromise (BEC) is fraud carried out through email that appears to come from a trusted business contact: an executive, a supplier, a customer or a lawyer. There is often no malware and no link; the message simply asks for a payment, a change of bank details or sensitive records. The FBI's Internet Crime Complaint Center (IC3) has for years listed BEC among the most costly types of cybercrime reported to it.

How it works

There are three common setups. In the first, the attacker writes from a lookalike domain or a free mailbox with a familiar display name. In the second, they forge the exact domain through email spoofing, which works mainly when that domain has no enforced DMARC policy. In the third, they take over a real mailbox, often through a phishing page, read the ongoing conversations and step in at the right moment. Typical scenarios include supplier invoices with new bank details, urgent transfers requested by "the CEO", payroll diversion and requests for employee tax records. Attackers may also add mailbox rules that hide replies from the real owner.

Example

An illustrative case: an accounts payable clerk receives an email from a long-standing supplier with a correctly formatted invoice and a note that the bank account has changed. The sender is accounts@examplesupplier-group[.]com rather than the supplier's usual domain. The clerk updates the details, and the next payment goes to the attacker.

How to spot it

• A change of bank details announced only by email.
• Slight differences in the sender domain, or a reply-to address that goes elsewhere.
• Urgency combined with secrecy or a request to bypass normal approval.
• An executive asking for gift cards, an unusual transfer or employee data.
• An existing thread that suddenly changes tone or asks to continue at another address.

What brands can do

• Enforce DMARC with p=reject on every domain you own, including parked ones.
• Require a call-back to a known number before any change in payment details.
• Protect mailboxes with phishing-resistant multi-factor authentication and alert on new forwarding rules.
• Monitor lookalike domains of your brand, and ask key suppliers to do the same for theirs.

Many BEC cases depend on a lookalike domain registered days before the attack. Phishvoid verifies such domains and files takedowns with the registrar and mail host; contact the team to discuss monitoring. For warning signs in individual messages, read How to spot a phishing email.

Read more: How to Spot a Phishing Email: 12 Signs and Examples