Business Email Compromise Explained

Business email compromise, or BEC, tricks employees into sending money or data by impersonating executives or vendors. It causes some of the largest losses from cybercrime.

How BEC works

Attackers take over or spoof an email account and send convincing requests such as changing bank details on an invoice or urgently paying a supplier.

Common variations

Fake invoices, executive impersonation, payroll diversion, and gift card requests are frequent forms. Attackers may watch email threads for weeks before striking.

Warning signs

Urgency, secrecy, new bank details, slight changes in email addresses, and unusual payment methods are red flags.

Prevent it

Require multi-factor authentication, set up SPF, DKIM, and DMARC, and verify payment changes by calling a known number. Use dual approval for transfers.

Respond quickly

If a payment was sent, contact your bank immediately to attempt recall and report to authorities. Secure compromised accounts.

Key takeaways

• How BEC works: Attackers take over or spoof an email account and send convincing requests such as changing bank details on an invoice or urgently paying a supplier.
• Common variations: Fake invoices, executive impersonation, payroll diversion, and gift card requests are frequent forms. Attackers may watch email threads for weeks before striking.
• Warning signs: Urgency, secrecy, new bank details, slight changes in email addresses, and unusual payment methods are red flags.
• Prevent it: Require multi-factor authentication, set up SPF, DKIM, and DMARC, and verify payment changes by calling a known number. Use dual approval for transfers.
• Respond quickly: If a payment was sent, contact your bank immediately to attempt recall and report to authorities. Secure compromised accounts.

Putting it into practice

To apply this in your own organization, begin with a short assessment of where you stand on business email compromise today. Write down who owns it, which tools are involved, and the single biggest gap. Fix the highest-risk gap first, assign a clear date, and review progress after thirty days. Share what you learn with the team so improvements stick, and document the decisions you make so new staff can follow them. Revisit the topic every quarter, because threats, tools, and business needs change quickly, and small regular adjustments are far easier than large emergency fixes.

Common mistakes to avoid

Many teams struggle with business email compromise because they try to do everything at once, skip documentation, or treat it as a one-time project. Others rely on a single person who holds all the knowledge, or buy tools before defining the problem they need to solve. Avoid these traps by starting small, writing down simple procedures, spreading responsibility across the team, and checking results on a regular schedule. If something is not working, adjust quickly instead of abandoning the effort, and keep a short log of what you changed and why. That record makes future decisions faster and helps new colleagues understand the reasoning behind your approach.

Next steps

Reading about business email compromise is a good start, but results come from action. Pick one improvement you can finish this week, assign it to a named person, and set a date to check that it is done. Then choose the next item and repeat. Keep notes on what worked so your team builds a library of practical, tested steps rather than relying on memory. If you are unsure where to begin, start with the area that would cause the most disruption if it failed, because that is where careful attention pays back fastest.

Frequently asked questions

Is BEC malware?

Usually not; it relies on social engineering.

Can banks reverse payments?

Sometimes if notified quickly.

Final thoughts

Verify payment requests through another channel and protect email accounts.