Business Email Compromise: The Phishing Attack That Costs Millions

Business email compromise causes more reported financial losses than any other cybercrime category. Understanding how it works is the key to stopping it.

Business email compromise (BEC) rarely involves malware↗, exploits, or anything a traditional antivirus↗ tool would catch. It's a targeted, patient social engineering↗ attack that exploits trust in everyday business communication, and it consistently ranks among the costliest categories of cybercrime by total financial loss.

How a typical BEC attack unfolds

Research. The attacker studies the target organization: who's the CEO, who's in finance, what vendors does the company use, when is a key executive traveling (often gleaned from social media or public conference schedules).
Access or spoofing↗. Either the attacker gains access to a real executive's email account (via a prior phishing↗ attack or credential leak), or registers a lookalike domain, a single character different from the real one, to send convincing spoofed messages.
The request. A message arrives, seemingly from the executive or a trusted vendor, requesting an urgent wire transfer, a change to vendor payment details, or sensitive employee data (often around tax season, targeting payroll or HR staff for W-2/tax-form data).
Urgency and authority. The message leans heavily on urgency ("I need this processed before my flight boards") and authority (appearing to come from someone the target wouldn't normally question), specifically designed to bypass the target's usual verification habits.
The loss. Once a fraudulent transfer is made, recovery is extremely difficult, funds typically move through several accounts within hours, often across borders.

Why BEC bypasses traditional technical defenses

Standard email security tools are built to catch malicious attachments and links. A BEC email often contains neither, just a well-written, contextually plausible text request. This is precisely why BEC has grown as ransomware↗ and malware detection has improved: it exploits the layer traditional tools can't inspect, human judgment under social pressure.

Practical defenses that actually work

Out-of-band verification for any payment or data request. Any request to change payment details or transfer funds gets verified through a separate channel, a phone call to a known number, not one provided in the email itself, regardless of how urgent or senior the requester appears.
Dual authorization↗ for financial transfers above a set threshold, with no exceptions for "the CEO asked directly."
Domain monitoring. Register close variations of your own domain, and monitor for newly registered lookalike domains targeting your organization.
Email authentication↗ standards (SPF, DKIM, DMARC) configured correctly, which prevents attackers from directly spoofing your exact domain, though it doesn't stop lookalike-domain attacks, making the verification habit above still essential.
Specific BEC-focused training, distinct from general phishing awareness, BEC preys on urgency and authority rather than malicious links, so training needs to specifically rehearse "pause and verify" as a habit even when a request appears to come from the CEO.

The uncomfortable reality about seniority and susceptibility

BEC attacks specifically target the trust that comes with organizational hierarchy, junior staff are trained not to question senior requests, which is exactly what attackers rely on. Effective defense requires organizational permission, explicitly granted from the top, for any employee to pause and verify an unusual request regardless of who it appears to come from, without fear of seeming to question authority.

Frequently Asked Questions

What is business email compromise?

A social engineering attack where a scammer impersonates an executive or trusted vendor by email to trick an employee into an urgent wire transfer or sensitive data disclosure, without any malware involved.

How do you stop business email compromise?

Require out-of-band verification (a phone call to a known number) for any payment or data change request, use dual authorization above a set threshold, and train staff specifically on BEC's urgency-and-authority pattern, not just generic phishing awareness.