What is Business Email Compromise?

BEC is a targeted scam where an attacker impersonates a trusted party — an executive, supplier or colleague — over email to trick an organisation into transferring money or sensitive data. It usually relies on social engineering rather than malware.

Why is BEC so costly?

Because it targets the people and processes that move money, and it looks legitimate. A single convincing request — a changed bank account on an invoice, an 'urgent' wire from the CEO — can send a large payment to an attacker before anyone checks.

How do you defend against BEC?

Layer defences: email authentication (SPF, DKIM, DMARC) to make spoofing your domain hard, strict out-of-band verification for payment and bank-detail changes, and monitoring for lookalike domains used to impersonate your company or suppliers.

Business Email Compromise (BEC), explained

Business Email Compromise is phishing that skips the malware and goes straight for the money. Instead of a mass campaign, BEC is a targeted con: an attacker poses as someone you trust and asks for a transfer, an invoice payment, or sensitive data. It is one of the costliest forms of cybercrime, precisely because it looks so ordinary.

The common forms

CEO fraud — a message "from the CEO" demanding an urgent, confidential wire transfer.
Invoice fraud — a real supplier relationship hijacked to change the bank details on an invoice.
Account compromise — a genuine mailbox is taken over and used to make requests from a trusted address.
Lookalike domains — a near-identical domain (a swapped letter) used to impersonate a colleague or vendor.

Why it works

BEC exploits authority, urgency and routine. A junior employee is unlikely to question the CEO; a finance team processes invoices all day. The request fits the normal flow of work, so it does not trigger suspicion — and by the time anyone double-checks, the money is gone.

BEC rarely contains a malicious link to scan. The attack is the message itself, which is why email authentication and process controls matter more than any filter.

How to defend

Lock down your domain with SPF, DKIM and DMARC so attackers can't spoof your real address.
Verify out of band — confirm payment and bank-detail changes by a known phone number, never by replying to the email.
Watch for lookalike domains impersonating your company and your key suppliers.
Train the money-movers — finance and leadership are the real targets.

Phish Plug monitors for lookalike domains that impersonate your organisation and its partners — a core ingredient of BEC — and helps take them down before they are used.

The takeaway

BEC is social engineering aimed at the people who move money. The defence is equal parts technical and procedural: authenticate your domain, verify requests out of band, and watch for the lookalike domains that make impersonation convincing.

Business Email Compromise (BEC), explained

The common forms

Why it works

How to defend

The takeaway

Related articles

Spear phishing vs. mass phishing: what's the difference?

Whaling: phishing that targets the executives

Clone phishing: when a real email comes back poisoned

Protect your brand from impersonation