In short
A BEC attack is an email fraud in which a criminal impersonates, or takes over the mailbox of, a director, colleague, supplier or adviser to trick staff into paying money or sending sensitive data. Messages are usually plain text with no malware, so prevention relies on behavioural AI, impersonation protection, DMARC, account takeover detection and a payment verification process.
Get a quote for BEC protection
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What is a BEC attack?
Business email compromise is fraud carried out through email conversations rather than malware. The criminal's aim is a payment or a piece of valuable data, and the email is simply the tool for creating trust and urgency.
Three things make a BEC attack hard to catch:
- No payload: the message usually contains no link or attachment, just a request, so malware scanning has nothing to find
- A believable sender: a lookalike domain, a display name copied from a real person, a reply-to address that quietly diverts the conversation, or a genuine mailbox the attacker has taken over
- Context from research: names, job titles, suppliers, projects and even holiday dates, gathered from public sources or from a compromised mailbox
When the email comes from a genuine compromised account, it can pass SPF, DKIM and DMARC checks and sit inside a real thread, which is why authentication alone does not stop BEC.
Types of BEC attack
BEC attacks fall into a handful of patterns. Most organisations see more than one.
| Type | How it works | Usually aimed at |
|---|---|---|
| Executive impersonation (CEO fraud) | An email appearing to come from a director asks for an urgent, confidential payment | Finance staff and personal assistants; see whaling attack |
| Invoice and supplier fraud | A fake invoice or a notice of changed bank details from a supplier, real or impersonated | Accounts payable; see invoice fraud |
| Account compromise | A staff mailbox is taken over and used to ask customers or colleagues for payment | Customers and colleagues of the victim; see email account takeover |
| Adviser impersonation | A message appearing to come from a solicitor, accountant or other adviser during a transaction | Directors, finance and clients in the middle of a deal or purchase |
| Payroll diversion | An "employee" asks HR or payroll to change the bank account their salary is paid into | HR and payroll teams |
| Data theft | A request for staff records, tax documents or customer data rather than money | HR, finance and operations |
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
BEC attack vs phishing
Business email compromise is a form of phishing in the broad sense, but it behaves differently and needs different defences.
| Typical phishing | BEC attack | |
|---|---|---|
| Goal | Steal credentials or install malware | Get a payment made or data sent |
| Content | Links or attachments | Usually plain text, no payload |
| Volume | Often sent widely | Few messages, aimed at specific people |
| Sender | Unknown or spoofed brands | Impersonated or compromised known contacts |
| Best technical controls | Link and attachment analysis, sandboxing | Behavioural and language AI, impersonation protection, account takeover detection |
| Key human control | Do not click or enter credentials | Verify requests through a known channel before acting |
The two are linked: credential phishing is often how an attacker gets into the mailbox later used for BEC. Our phishing protection guide covers the first stage.
Business email compromise examples
These generic examples show the patterns without naming real organisations:
- The urgent director: late on a Friday, the finance assistant receives an email from the managing director's name on a lookalike domain asking for a confidential payment to secure a deal, with a request not to discuss it
- The supplier's new bank: accounts payable receives a reply in a genuine thread with a long-standing supplier, saying their bank details have changed for the next invoice. The supplier's mailbox has been compromised
- The completion funds: a client buying property receives an email that appears to come from their solicitor with updated account details for completion money
- The salary change: payroll receives a polite request from a staff member's name asking for their salary to go to a new account from next month
In each case the technical clue is subtle (a domain one character different, a reply-to address, a first-time request from a known contact, unusual sending behaviour) and the process clue is the same: a change to how money moves, requested by email.
Is BEC protection the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How to prevent business email compromise: technical controls
Because BEC carries no payload, the controls that work look at who is writing, how and to whom:
- Behavioural and language AI: products that learn normal communication patterns and analyse the intent of a message. IRONSCALES, Check Point Email Security and FortiMail Workspace Security all target BEC; Vade's anti-spear-phishing uses anomaly detection and natural language processing; Trend Micro's writing style analysis compares a message with how the supposed sender normally writes
- Impersonation protection: in Microsoft Defender for Office 365, user and domain impersonation protection and mailbox intelligence; in Gmail, the settings that protect against similar domain names and spoofing of employee names
- External and first-contact warnings: Microsoft's first contact safety tip and external banners give staff a cue that a familiar name is coming from an unfamiliar address
- DMARC on your own domain: stops criminals sending as your exact domain to your staff, customers and suppliers; see email authentication and DMARC
- Account takeover detection: spots compromised mailboxes, the source of the most convincing BEC; see email account takeover
- Controls on forwarding and inbox rules: attackers often hide replies with rules and forward mail outside the organisation, so alert on and restrict both
Several of these sit in an integrated cloud email security product, which works inside Microsoft 365 or Google Workspace and can remove a fraudulent message from every mailbox once it is spotted.
Process controls that stop the payment
Technology lowers the number of BEC emails that reach people; process stops the money moving when one does. The controls that matter most are simple:
- Treat any new payment request or change of bank details received by email as unverified until confirmed.
- Confirm using contact details you already hold, such as the number on file or the supplier record, not details in the email.
- Require a second person to approve new payees and changes to existing payee details.
- Use your bank's Confirmation of Payee check and act on a mismatch.
- Make it safe for staff to slow down an "urgent, confidential" request from a senior name.
Staff need to know these rules and why they exist. Our sister site covers that in business email compromise training.
How we help
We can help you put technical BEC controls in place on Microsoft 365 or Google Workspace and choose a product that fits. We can:
- Review your impersonation, spoofing and forwarding settings and your DMARC status
- Trial a behavioural AI product in monitoring mode on your own mail, where the product supports it
- Recommend, license and deploy the option that fits, with package contents confirmed at quote
Ask us for a quote: Contact us about protecting your organisation from BEC attacks.
How Forever Systems helps with email security
We are an independent UK IT and cyber security provider. We supply several email security platforms, so we can suggest what suits your mail system, your risks and your budget rather than pushing one product.
- Start with what you have: we can review the protection already built into Microsoft 365 or Google Workspace before suggesting anything extra
- Compare like for like: API-based protection, secure email gateways, encryption and DLP from the vendors we supply, explained in plain English
- Get authentication right: we help you plan SPF, DKIM, DMARC and MTA-STS so genuine mail is delivered and spoofed mail is not
- Deployment help: connecting a platform to Microsoft 365 or Google Workspace, mail routing changes and policy set-up, scoped at quote
- People and backup too: security awareness training, Check Point Harmony Email & Collaboration and Sophos from our specialist sites
Tell us about your mail system and we will suggest options, with pricing confirmed at quote.
Frequently asked questions
What is a BEC attack?
A BEC (business email compromise) attack is email fraud in which a criminal impersonates or takes over the mailbox of a trusted person, such as a director, supplier or adviser, to trick staff into paying money or sending sensitive data. The emails usually contain no malware.
What is the difference between BEC and phishing?
Phishing usually uses links or attachments to steal credentials or install malware and is often sent widely. A BEC attack targets specific people with a plain request for payment or data, from an impersonated or compromised known contact, so it needs behavioural and impersonation controls.
How do you prevent business email compromise?
Combine technical and process controls: behavioural AI and impersonation protection on inbound mail, DMARC on your own domain, account takeover detection, restrictions on forwarding, and a rule that payment changes are verified through a known channel with a second approver.
Does DMARC stop BEC attacks?
Only partly. DMARC stops criminals sending as your exact domain, but not lookalike domains, display-name tricks or messages from a genuinely compromised mailbox, which pass authentication. It is one layer among several.
What should I do if we have been hit by a BEC attack?
Contact your bank straight away using its official contact details, report it to Report Fraud (or Police Scotland in Scotland), secure the affected mailbox, remove malicious inbox rules and forwarding, and tell affected customers or suppliers through a channel you already trust.
Still have a question about BEC protection?
Ask us and a member of our team will reply by email.