Business email compromise (or BEC for short) is a category of cyberattack that involves targeting, impersonating, or taking over business email accounts. This type of attack has surged in popularity as more businesses have transitioned to cloud-based infrastructure in recent years.
Such cloud-based networks are great for businesses but have notoriously weak security, especially given the level of access they provide to a company’s inner workings. Overall, they’ve become major targets for hackers.
Business email compromise is a worldwide issue for small and large businesses alike. In total, BEC attacks have cost companies billions of dollars over the years. But they’re not impossible to prepare for and prevent. Read on to learn how you can defend yourself and your business against business email compromise attacks.
What is BEC?
Before we go over prevention measures, let’s explore the business email compromise definition in depth. So, what is BEC?
It’s a social engineering attack that targets a victim at a company and sends a seemingly legitimate email claiming to be from a trusted source. The email typically requests money or some kind of information for a supposedly legitimate reason. Upon closer inspection, it’s usually apparent that the sender is not who they claim to be.
How Does Business Email Compromise Work?
With the amount of damage that this type of scam has caused, the FBI has investigated the matter extensively. They define five major categories for BEC attacks:
- Bogus Invoice Scheme: The attacker pretends to be one of the company’s goods or services providers and sends an invoice to request funds to a false account.
- CEO Fraud: The attacker mimics an executive position in the company and sends an email to an individual employee requesting either information or funds.
- Account Compromise: The attacker manages to get hold of an employee’s email account to request payments be made for various services into the attacker’s false bank accounts.
- Attorney Impersonation: The attacker appears to be a legal representative and targets members of a company with low knowledge of the business’s legal affairs. Once they’ve established a false sense of authority, they make requests for funds or information.
- Data Theft: Attackers target HR and other employees to obtain sensitive data about the company or even personal information about higher-ups and executives. This information can be used against the company in the future.
The above methods require some way for the attacker to take advantage of human error and acquire data. There are three common ways to do this:
- Official Domain Spoofing: The attacker creates a fake site or email account whose domain mirrors the official one. This is then used to trick individuals into trusting them and following any demands.
- Lookalike Domain Spoofing: The attacker creates a domain with a typo or slight alteration of the official domain’s name. Usually, this involves a fake website or email account that purposefully replicates the official version. The goal is to exploit employees who miss the small alteration to the domain.
- Compromised Accounts: The attacker gets hold of an official account and uses it to take advantage of any connections the individual has. Anyone who trusts that account is at risk, and the attacker exploits this to spread their scams.
Business Email Compromise Examples
Now that we know the “how” of BEC attacks, let’s discuss a few real cases. Here are some known business email compromise examples from the last several years:
- Toyota, 2019: An attack targeting Japan’s Boshoku Corporation CEO cost the company $37 million due to a false wire transfer scam.
- COVID-19 Health Organizations, 2020: As the public’s desire for information about the pandemic rapidly soared, so too did scam opportunities. Using fake domains designed to resemble trusted organizations such as the World Health Organization, scammers spread malware and misinformation as efficiently as the disease itself.
- Treasure Island Homeless Charity, 2021: Attackers always look for weak links to exploit, and most charities lack cybercrime insurance. This San Francisco-based one wasn’t an exception, either. Hackers gained access to the system via a bookkeeper’s email and launched a month-long attack, resulting in losses of $625,000.
What Are the Types of Business Email Compromise (BEC) Attacks?
Business email compromise attacks can take different forms depending on who the attacker impersonates and what they want from the victim. Some BEC attacks target company executives, while others focus on finance teams, vendors, or HR employees. Here are five common types of BEC attacks businesses should know about.
Executive Impersonation (CEO Fraud)
In executive impersonation, attackers pretend to be a CEO, CFO, or another senior leader to convince employees to follow their instructions. They may ask for an urgent wire transfer, confidential company information, or gift cards for a supposed business expense.
These emails often use a sense of urgency or secrecy to stop employees from checking whether the request is genuine. For example, an attacker may email an accounts team member pretending to be the CEO and ask them to transfer money to a new bank account before the end of the day.
Hijacked Employee Email Accounts
Some BEC attacks begin when cybercriminals gain access to a legitimate employee’s email account. They may steal login credentials through phishing or use another method to break into the account.
Once inside, attackers can read old email conversations, learn how the company handles payments, and identify people who trust the account owner. They can then send fraudulent payment requests from the compromised account or take over an existing conversation. Since the messages come from a real account, recipients may find them harder to recognize as scams.
Fake Invoice and Vendor Payment Scams
In a fake invoice or vendor payment scam, attackers pretend to be a trusted supplier or business partner. They may send a fraudulent invoice or ask the finance team to update the bank details used for future payments.
For example, a company may receive an email that appears to come from a regular supplier, explaining that the supplier has changed its bank account. If an employee updates the payment details without verifying the request, the next payment could go directly to the attacker.
These business email compromise scams often exploit existing business relationships, making it important to verify payment changes through a trusted contact method.
Posing as a Lawyer or Legal Representative
Attackers may impersonate a lawyer or legal representative to pressure employees into transferring money or sharing confidential information. They often use the sensitive nature of legal matters to make their requests seem urgent and private.
For example, an attacker might pretend to represent the company in a confidential acquisition or legal dispute. They may ask an employee to make an immediate payment or share financial documents without informing other team members.
Employees should verify such requests directly with the company’s legal team or the law firm using contact details they already trust.
Stealing Sensitive Employee Data
Not every BEC attack is focused on stealing money directly. Some attackers target HR employees, payroll teams, or other staff members who can access confidential business and employee information.
An attacker may impersonate a senior executive and ask HR to share employee tax records, salary details, or personal information. They may also target payroll employees with fraudulent requests to change an employee’s bank account details.
Stolen information can be used for identity theft, payroll fraud, or further attacks against the company. Businesses should verify sensitive data requests and restrict access to employee information based on job responsibilities.
Why is BEC Effective?
While malware and viruses can be prevented and defended against, human error is a factor that all systems suffer from. Business email compromise (BEC) attacks take advantage of this component as much as possible.
Whether they target someone on the bottom of the corporate ladder or the very top, attackers are bound to find a mistake or slip somewhere. They exploit this to gain a foothold, acquire information, and even siphon funds from the company. The process is similar, whether it’s a small five-person team or a several-thousand-employee mega-corporation.
How to Avoid BEC Attacks
Since BEC attacks prey on simple mistakes, there are steps you can take to avoid them. Here are a few tips to help you and your team prevent business email compromise:
Don’t Overshare on Social Media
Always be mindful of what information you’re sharing on social media. If an attacker is determined enough, they’ll go digging. And they’ll find details to use as hooks to further the attack.
Don’t Rush into Taking Action, Especially if Pushed
A sense of urgency in emails and messages (especially from sources you don’t trust/recognize) should always be taken with a grain of salt. What’s the hurry? If their reason for rushing you into action is vague or sounds suspicious, don’t fall for any demands. Take your time, and don’t make rash decisions just because an email sounds frantic.
Verify the Sender, the Address, the URL, etc.
This one requires a careful eye. Take extreme caution in ensuring and double-checking the validity of any URLs, domains, senders, etc. You can talk to the sender over the phone, check the links for any typos, and make sure the email address is on your contact list.
Set Up Two or Multifactor Authentication
While most people groan and roll their eyes at any prompt for you to upgrade your account’s security with multi-step verification, it really is a good idea. Simply put, it’s another added layer of protection that’ll keep attackers from preying on your account.
Label External Emails
Be cautious of any emails that aren’t in your contacts or business directories. Always scrutinize first-time emailers before opening or interacting with anything they send.
Verify Requests in Person Even if They’re from the Bosses
Requests and demands (especially those dealing in information or transactions) should be verified person-to-person. Don’t take a friendly message from the “boss” at face value. Confirm that they are the official sender.
Implement DMARC and Anti-Phishing Protection
DMARC (or domain-based message authentication) and other anti-phishing protocols have become vital for reducing incoming BEC attempts against employees in the workplace. Such security measures greatly reduce the chance of human error that creates cracks in a system’s security. That’s why businesses massively benefit from implementing protocols like DMARC.
Final Thoughts
While systems can be compromised by common human mistakes that anyone can make, there are plenty of ways to prevent and defend against BEC scams. Be cautious and make sure that all team members keep their wits about them online.
Always verify email accounts, first-time emailers, and URLs, and don’t rush into rash decisions. Confirm important requests in person and set up two- or multi-factor verification. Lastly, implement security measures like DMARC to reduce BEC attacks and help keep your organization and employees safe.
Frequently Asked Questions
Regular phishing often uses fake links or attachments to steal credentials or install malware. BEC focuses on impersonating trusted people to trick victims into transferring money or sharing sensitive information, often without using malicious links or attachments.
Warning signs include unexpected payment requests, changes to vendor bank details, unusual requests for confidential data, and pressure to act quickly. Check the sender’s full email address and verify suspicious requests through another trusted communication channel.
DMARC helps prevent attackers from spoofing your domain by checking whether messages pass email authentication through SPF or DKIM and meet the required alignment rules. However, it cannot stop every BEC attack, especially those sent from compromised legitimate accounts.
Traditional email filters often look for malicious links, attachments, malware, and suspicious sender details. BEC emails may contain none of these signs and instead rely on convincing language and trusted identities, making them harder to detect automatically.
We’re glad you joined EasyDMARC newsletter! Get ready for valuable email security knowledge every week.
You’re already subscribed to EasyDMARC newsletter. Continue learning more about email security with us