Business Email Compromise: How These Scams Work
Date Published
Business email compromise, or BEC, doesn’t rely on malware or hacking in the traditional sense — it relies on a convincing email and a moment of urgency. It’s consistently one of the costliest categories of cybercrime for exactly that reason: no technical defense stops a human being persuaded to act.
The playbook attackers use
A typical BEC attack starts with research — attackers study a company’s public information, org chart, and communication style, sometimes after first compromising a real employee’s inbox to study genuine email threads. They then send a message impersonating an executive or vendor, usually with urgency built in: an invoice that must be paid today, a wire transfer needed before a deal closes, or a request for sensitive employee data framed as routine.
Why it bypasses normal security tools
BEC emails often contain no malicious link or attachment at all, which is precisely why spam filters and antivirus tools frequently let them through — there’s nothing technically malicious to detect. The attack lives entirely in the social engineering: a spoofed or slightly-altered sender address, a plausible request, and pressure to act fast before anyone double-checks.
Controls that actually work
The single most effective control is a verification step for anything involving money or sensitive data: any request to change payment details or wire funds gets confirmed through a second channel, like a phone call to a known number, never by replying to the email itself. Beyond that, enabling DMARC, SPF, and DKIM on your company domain makes it much harder for attackers to spoof your own domain convincingly, and flags obvious spoofing attempts before they reach an inbox.
Train for the specific pattern, not just “phishing” in general
Generic phishing training often misses BEC because there’s no suspicious link to point at. Train employees specifically on the pattern: urgency plus a request involving money, credentials, or sensitive data is the signal to slow down and verify — regardless of how legitimate the sender name looks.