Business email compromise

The quiet, expensive scam

Business email compromise (BEC) is where the big money is lost. It is not a flashy attack with malware. It is a carefully written email about a payment, sent to the person who can make that payment, at a moment when it looks completely normal.

The goal is simple: get real money sent to the attacker's account instead of the right one. Because the request fits the everyday flow of business, it often sails past people who would spot a clumsy phishing email in a second.

How it works

A typical BEC unfolds patiently. The attacker gains access to, or convincingly imitates, an email account, often a supplier's or a senior manager's. Sometimes they sit quietly inside a real mailbox for weeks, reading how the business talks to its partners: the tone, the names, the timing of invoices.

Then, at the right moment, they send a message that fits right in:

• an invoice from a familiar supplier, with new bank details "because we have changed banks"
• an urgent note from the boss asking finance to make a wire transfer before end of day
• a request to update the account where an employee's salary is paid

Nothing about the email looks broken. The language is right, the amount is plausible, and the story explains itself. That is exactly what makes it dangerous.

A worked example

A finance officer receives an email that appears to be from a regular supplier. The invoice is for a normal amount, the format matches previous ones, and the only difference is a line noting that the supplier's bank account has changed, so please pay the new one.

• The setup: the attacker has watched this supplier relationship and copied its style.
• The hook: a change of bank details, wrapped in an ordinary invoice.
• The loss: if the officer pays, the money goes to the attacker, and it is usually gone for good.

The weak point is not the officer's intelligence. It is that there was no step forcing anyone to confirm the change before the money moved.

The one habit that stops it

BEC targets a gap in your process, so the fix is a step in your process. Treat any change to payment details, a new bank account, a different beneficiary, an unusual urgent transfer, as something to confirm before you act, every time, no exceptions.

Verify the change through a separate, trusted channel: phone the supplier or the manager on a number you already have on file, not one printed in the suspicious email. A one minute call is nothing against the amount at risk.

Check yourself