Business Email Compromise: The Phishing Attack That Costs Millions
Business email compromise causes more reported financial losses than any other cybercrime category. Understanding how it works is the key to stopping it.
What is business email compromise?
A social engineering attack in which a scammer impersonates an executive or trusted supplier by email to trick an employee into an urgent transfer or a disclosure of sensitive data, usually without any malware.
Business email compromise (BEC) rarely involves malware↗ or anything a traditional antivirus↗ tool would catch. It is a targeted, patient scam that exploits trust in everyday business communication: a convincing email, apparently from your boss or a supplier, asking for money or sensitive data. It consistently ranks among the costliest categories of cybercrime by total financial loss. Understanding how it works is the key to stopping it.
How a typical BEC attack unfolds
- Research. The attacker studies the organization: who the chief executive is, who works in finance, which suppliers are used, and when a key executive is traveling (often gleaned from social media or conference schedules).
- Access or spoofing↗. Either the attacker gets into a real executive's mailbox (through an earlier phishing↗ attack or a leaked password), or registers a lookalike domain, an address that differs from the real one by a single character, such as examp1e.com instead of example.com.
- The request. A message arrives, seemingly from the executive or a trusted supplier, asking for an urgent transfer, a change to a supplier's bank details, or sensitive staff data such as payroll or tax records.
- Urgency and authority. The message leans on urgency ("I need this before my flight boards") and on rank, designed to bypass your usual checking habits.
- The loss. Once a fraudulent transfer is made, recovery is very difficult. The money usually moves through several accounts within hours, often across borders.
A worked example
An accounts clerk receives an email that looks like it came from a regular supplier: "Our bank details have changed. Please use the new account for this month's invoice." The writing is polished, the invoice number is correct (the attacker saw it in a hacked mailbox), and the address differs from the real one by one letter. Without a verification rule, the clerk pays. With one, the clerk calls the supplier on the number already on file, learns the request is false, and the money never leaves.
Why BEC bypasses traditional technical defenses
Email security tools are built to catch malicious attachments and links. A BEC email often contains neither, just a well-written, plausible request. This is why BEC has grown as malware detection has improved: it targets the layer that tools cannot inspect, human judgment under social pressure.
Practical defenses that actually work
| Defense | What it means |
|---|---|
| Out-of-band verification | Verify any request to pay or to change payment details through a separate channel, such as a call to a number you already hold, never a number given in the email. This applies however urgent or senior the requester seems. |
| Dual authorization↗ | Two people must approve transfers above a set amount, with no exception for "the boss asked directly". |
| Domain monitoring | Register close variants of your own domain and watch for new lookalike domains aimed at your organization. |
| Email authentication↗ (SPF, DKIM, DMARC) | Technical settings that make it much harder for attackers to send mail that appears to come from your exact domain. They do not stop lookalike domains, so the verification habit remains essential. |
| BEC-specific training | Rehearse "pause and verify" as a habit. BEC preys on urgency and authority rather than harmful links, so general phishing training is not enough. |
| Multi-factor authentication | Protects mailboxes, making it harder for criminals to read your real email threads. |
If you suspect a fraudulent payment
- Call your bank immediately and ask for the transfer to be recalled. Speed matters, because early reports give the best chance of recovery.
- Tell your management and your IT contact, and keep the emails as evidence.
- Report it to the police or cybercrime reporting service in your country.
- Check the affected mailbox for new forwarding rules and change its password.
The uncomfortable reality about seniority
BEC exploits the trust that comes with hierarchy. Junior staff are taught not to question senior requests, and that is exactly what attackers rely on. Effective defense needs permission from the top, stated openly, for any employee to pause and verify an unusual request, whoever it seems to come from, without fear of looking like they are questioning authority.
Frequently Asked Questions
What is business email compromise?
A social engineering↗ attack in which a scammer impersonates an executive or trusted supplier by email to trick an employee into an urgent transfer or a disclosure of sensitive data, usually without any malware.
How do you stop business email compromise?
Require out-of-band verification (a phone call to a known number) for any payment or payment-detail change, use dual authorization above a set amount, and train staff on BEC's urgency-and-authority pattern, not only on generic phishing.
Related reading
