Business email compromise (BEC) is a fraud in which attackers impersonate or take over a trusted email account, such as an executive, employee or supplier, to trick staff into paying fake invoices, changing bank details or sending sensitive data. BEC is consistently among the costliest cybercrimes reported to the FBI’s Internet Crime Complaint Center (IC3). Prevention needs both technical controls, such as MFA and email authentication, and finance processes, such as verified callbacks for payment changes.
Key Takeaways
- BEC often uses no malware, so it can bypass traditional antivirus.
- Account takeover is prevented best with phishing-resistant MFA and Conditional Access.
- SPF, DKIM and DMARC reduce spoofing of your own domain.
- Out-of-band verification for payment changes stops most fraud attempts.
- Monitor for suspicious inbox rules and forwarding, a classic BEC indicator.
How BEC Attacks Work
- Attacker phishes credentials or registers a lookalike domain.
- They study email threads, invoices and approval processes.
- They create inbox rules to hide replies or forward mail.
- They send a convincing request: urgent wire transfer, new bank details, gift cards or payroll changes.
- Funds are moved quickly through mule accounts.
12 Controls to Prevent BEC
Technical controls
- Enforce MFA for all users, prioritizing phishing-resistant methods.
- Deploy Conditional Access with device compliance and risk-based policies.
- Block legacy authentication.
- Publish SPF, DKIM and DMARC, moving DMARC to quarantine or reject.
- Use advanced email security such as Defender for Office 365 with impersonation protection.
- Flag external email with banners.
- Block automatic external forwarding by default.
- Alert on suspicious inbox rules and unusual sign-ins.
Process controls
- Verify payment changes by phone using a known number, never one from the email.
- Require dual approval for wire transfers above a threshold.
- Train finance and executive assistants with realistic BEC scenarios.
- Have a rapid response plan including contacting your bank immediately.
Warning Signs
| Sign | Example |
|---|---|
| Urgency and secrecy | “Process this today, do not call me, I’m in a meeting” |
| Changed bank details | “We have a new account for all future payments” |
| Lookalike domains | Slightly misspelled supplier domain |
| Reply-to mismatch | Reply goes to a different address |
| Unusual requests | Gift cards, payroll redirection, W-2 data |
If BEC Happens
- Contact your bank immediately to try to recall funds.
- Report to law enforcement (in the US, the FBI’s IC3).
- Reset credentials, revoke sessions and remove malicious inbox rules.
- Follow your incident response plan.
How Skytech Enterprise Helps
Our enterprise email security service configures Defender for Office 365, DMARC and monitoring, while digital risk protection helps spot lookalike domains. Request an email security review.
Frequently Asked Questions
What is business email compromise?
BEC is a scam where attackers use compromised or spoofed email accounts to trick people into sending money or sensitive information.
Does MFA stop BEC?
MFA greatly reduces account takeover, though some phishing kits can steal session tokens. Phishing-resistant MFA and Conditional Access provide stronger protection.
What is DMARC?
DMARC is an email authentication policy that tells receiving servers how to handle messages that fail SPF and DKIM checks for your domain.
Can BEC happen through a supplier’s account?
Yes. Vendor email compromise uses a real supplier’s hacked account, which is why payment change verification is essential.
What should finance teams do differently?
Verify all bank detail changes by calling a known contact, use dual approval for large payments and be suspicious of urgency.
Is BEC covered by cyber insurance?
Coverage varies by policy. Some policies cover social engineering fraud with sublimits; review your policy terms.