Business email compromise, usually shortened to BEC, is a family of fraud in which an attacker uses email to persuade someone to move money, send sensitive data, or change payment details. It rarely involves malware. The attacker relies on a believable sender, a plausible reason, and a sense of urgency. This article describes how the common variants work and the basic controls that reduce their chance of success.
How BEC works
A typical attack has three stages. First, the attacker learns about the target organisation, its people, and its payment processes. Public sources such as company websites, professional profiles, and event listings are often enough. Second, the attacker gains a position from which to send convincing mail. That may be a compromised mailbox, a look-alike domain, or a spoofed From address that the receiver's authentication does not catch. Third, the attacker makes a request that looks routine.
Common variants include:
- Executive impersonation: a message appears to come from a senior person, asking an assistant or finance staff member to pay an invoice urgently or buy gift cards.
- Vendor impersonation: an attacker who has access to a supplier's thread, or who mimics a supplier, sends new bank details for future payments.
- Payroll redirection: a request to change the bank account on an employee's payroll record.
- Invoice fraud: a fake invoice with a changed account number, inserted into an ongoing legitimate thread.
Why the mail itself can look fine
Many BEC messages pass SPF and DKIM, because they come from a real, compromised account or from a look-alike domain the attacker controls and has configured correctly. A message with no malware, no suspicious link, and a plausible sender is the kind a filter is least likely to block. Authentication helps against spoofing of your own domain, but it does not tell you whether a request is genuine.
Look-alike domains
Attackers register domains that differ slightly from the target. Common patterns include a changed letter (examp1e.com), a doubled letter, an added hyphen, a different top-level domain, or a homoglyph that uses characters resembling Latin letters. The display name can also be set to match a real person while the address differs. Read the address, not just the name, whenever a request involves money or data.
Defences that work
Verify payment changes out of band
The most effective control is a rule that any change to payment details is confirmed by phone or another channel, using a number already on file, never a number supplied in the message. Apply the rule even when the request appears to come from the chief executive, and make sure staff can refuse without fear of reprisal.
Require two people for payments
A payment above a set threshold should need approval from a second person, through a process separate from email. An attacker who controls one mailbox then has to deceive a second person as well.
Lock down your own domain
Publish SPF and DKIM for your domain, and set DMARC to p=quarantine or p=reject once your reports show that legitimate mail passes. This stops straightforward spoofing of your own domain. See SPF, DKIM and DMARC explained.
Protect the mailboxes
Most serious BEC begins with a compromised account. Use a FIDO2 key or a TOTP app for mail logins, as described in hardware keys vs TOTP. Review sessions regularly and revoke any you do not recognise. Attackers often add forwarding rules or filters that hide replies from the victim, so audit those too. On ITProMail, filters are managed under Account > Filters, and forwarding is configured separately. Check both after any suspicious login.
Watch for reply and address anomalies
Check the Reply-To address before acting on a request. A supplier message that replies to a different domain is suspicious, and so is a message whose sender address differs from the one you have on record. Train staff to check these details first. The headers show the authentication results if you need to confirm them.
What to do if it happens
- Stop. Do not complete the payment or send the data.
- If money has moved, contact your bank immediately. Speed matters for recovery.
- Report it to your own IT or security contact. If the affected account is on ITProMail, report it to security@itpromail.com.
- Check the affected mailbox for forwarding rules, filters, and sessions, and change its password and app passwords.
- Warn the supplier or colleague whose identity was used.
Practice
Controls only work if people use them. Make the payment-change procedure short, written down, and known to everyone who needs it. Run occasional tests in which staff receive a realistic request and report it rather than act on it. The aim is a process that does not depend on anyone spotting the forgery.