AMDigitec InsightsKey takeaways
- Business email compromise (BEC) tricks people into sending money or sensitive information by impersonating someone they trust.
- It rarely involves malware, so traditional security tools often miss it. The attack is the request itself.
- The defence is a combination: domain protection, secure mailboxes, a payment verification process and people who know what to look for.
The most damaging email a business receives often looks completely ordinary. No attachment, no strange link, no spelling mistakes. Just a short message from a supplier, a partner or the boss, asking for something reasonable at a busy moment: an updated bank account, an urgent payment, a quick favour.
That is business email compromise. It is one of the most costly forms of cybercrime precisely because it targets trust and routine rather than technology.
What business email compromise is
Business email compromise is a fraud in which a criminal impersonates someone your team trusts, usually by email, to redirect a payment or extract sensitive information. The message may come from a look-alike domain that differs from the real one by a single character, or from a genuine mailbox the attacker has quietly taken over.
Because there is often nothing technically malicious in the message, it can pass through filters that are designed to catch viruses and suspicious links. What makes it dangerous is context: the right name, the right tone and the right timing.
How a typical attack unfolds
Most BEC attacks follow a recognizable pattern:
- Research. The attacker studies your business: who approves payments, which suppliers you use, when large transactions happen.
- Impersonation or access. They register a look-alike domain, or gain access to a real mailbox through a stolen password.
- Timing. They wait for a moment when a payment is expected, such as a supplier invoice, a property closing or the end of a month.
- The request. A message asks for new banking details to be used, an urgent transfer or confidential information.
- The exit. Once the money moves, it is transferred onwards quickly, which is why speed matters if you suspect fraud.
The most effective defence against business email compromise is not a product. It is a habit of verifying any change to how money moves.
The common forms of BEC
| Type | What it looks like | Who it targets |
|---|---|---|
| Executive impersonation | An urgent request that appears to come from a senior leader | Finance and administrative staff |
| Supplier invoice fraud | A familiar supplier announces new banking details | Accounts payable |
| Account takeover | A real mailbox is used to send convincing requests | Anyone the mailbox normally emails |
| Payroll diversion | An employee appears to ask HR to change their deposit account | HR and payroll |
| Closing and settlement fraud | Altered payment instructions arrive just before a transaction closes | Law firms, real estate and their clients |
For law firms in particular, closing-day fraud is a serious risk. We cover it in more depth on our legal IT page.
Business email compromise vs phishing
Phishing usually casts a wide net: thousands of generic messages trying to get someone to click a link or open an attachment. Business email compromise is targeted and patient. It often contains no link at all, and it is written for one person in one business. Many BEC attacks begin with phishing, which is used to steal the password that later gives the attacker access to a real mailbox.
Get AMDigitec Insights by email
The controls that stop it
No single tool prevents business email compromise. The businesses that resist it combine a few practical controls:
- Protect your domain. SPF, DKIM and DMARC records make it much harder for criminals to send email that appears to come from you.
- Secure every mailbox. Multi-factor sign-in stops most attempts to take over an account with a stolen password.
- Verify payment changes out of band. Any new or changed banking details are confirmed by calling a known phone number, never one supplied in the email.
- Watch for warning signs in mailboxes. New forwarding rules and unusual sign-ins are early signs that an account has been compromised.
- Train your people. Staff who know what these requests look like, by email, phone or text, are your last and best line of defence.
Process matters as much as technology. A simple rule that every banking change is confirmed by phone stops a large share of these attacks, at no cost.
What to do if you suspect BEC
- Contact your bank immediately and ask them to stop or recall the payment. The first hours matter most.
- Do not reply to the suspicious message. Contact the supposed sender using details you already have.
- Secure the affected account: change the password, sign out all sessions and check for forwarding rules.
- Preserve the evidence. Keep the messages and their headers; they show how the attack happened.
- Report it. In Canada, report fraud to the Canadian Anti-Fraud Centre and your local police. In the United States, report it to the FBI’s Internet Crime Complaint Center.
If you need help understanding what happened and closing the gap, that is exactly what our email security and incident investigation service does.
Common questions
Is business email compromise the same as phishing?
No. Phishing is broad and usually relies on links or attachments. Business email compromise is targeted, often contains no link at all, and relies on impersonation and timing.
Can email security software stop BEC on its own?
It helps, especially domain protection and account security, but it cannot judge whether a request is legitimate. Verification habits and trained staff are just as important.
Who is most at risk?
Anyone who can approve or change payments: finance teams, executives and their assistants, payroll staff, and firms that handle client funds, such as law and accounting practices.
Where should we start?
With a clear picture of where you stand. An IT & Security Assessment checks your email protection, account security and the processes around payments.