Business email compromise

What it means

Business email compromise, or BEC, is fraud carried out through email that appears to come from someone the victim trusts. The attacker either takes over a real mailbox or fakes the sender, then asks for something ordinary: a changed bank account, an urgent transfer, a payroll update, or a file of customer data.

The idea that makes it click: there is often no malware and no technical break-in to detect. The message is simply a believable request, sent at the right moment, that someone acts on. The weak point is the process around payment and approval, not only the mailbox.

Why it matters

The losses are direct and usually hard to recover. A supplier invoice paid to a new account is gone within hours, and banks can rarely reverse it once the funds move on. The FBI's Internet Crime Complaint Center has reported business email compromise as one of the costliest categories of cybercrime it tracks.

A compromised mailbox also exposes whatever the owner could see: contracts, customer lists, password reset emails. That can start an account takeover in your own product, or a data incident you must report under breach notification rules. Speed of response decides how much comes back.

How it shows up

It starts with phishing that steals a mailbox password, or with a lookalike domain such as one letter changed. The attacker reads threads for days, learns who approves payments, then replies inside a real conversation with new bank details. Forwarding rules hide the replies from the owner.

Controls that work: multi-factor authentication on every mailbox, SPF, DKIM and DMARC on your domain, alerts for new forwarding rules, and a rule that bank detail changes are confirmed by phone on a number you already had. Process beats vigilance.