What is business email compromise? A Practitioner's Definition

Definition

Business email compromise (BEC) is a form of fraud where attackers use email, or email-like communication, to impersonate a trusted person or business process and trick someone into sending money, credentials, or sensitive information. Unlike many phishing attacks, BEC often relies more on social engineering and account misuse than on malicious attachments or obvious malware.

How it works

BEC works by inserting the attacker into a normal business workflow: accounts payable, payroll, procurement, legal review, executive requests, or vendor communications. The attacker studies how the organization operates, then sends a message that looks routine enough to avoid suspicion.

Common BEC patterns include:

• Executive impersonation: An attacker pretends to be the CEO, CFO, or founder and asks for an urgent wire transfer, document, or gift card purchase.
• Vendor or invoice fraud: A supplier’s account is spoofed or compromised, and the victim is told future payments should go to a new bank account.
• Payroll diversion: HR or payroll receives a request to change an employee’s direct deposit information.
• Account compromise: The attacker gains access to a real mailbox and uses existing threads, signatures, and timing to make the fraud more believable.
• Data theft or pretexting: Instead of asking for money first, the attacker requests W-2s, tax records, customer data, or login credentials.

A typical attack chain looks like this:

1. Reconnaissance: The attacker learns who approves payments, who manages vendors, and which executives travel or delegate authority.
2. Impersonation or takeover: They either spoof a lookalike domain, use a free webmail account with a convincing display name, or log into a compromised mailbox.
3. Pretext creation: They craft a plausible reason for urgency, confidentiality, or a process exception.
4. Action request: The victim is asked to transfer funds, buy gift cards, send files, share credentials, or update banking details.
5. Follow-up pressure: The attacker pushes for quick completion and discourages phone verification or normal approval steps.

What makes BEC effective is that the message usually fits a real business context. It does not need to be technically advanced if it feels operationally normal.

Technical Notes

Common signs in email headers and message content include:

- Reply-To address does not match the From domain
- Lookalike domains such as cornpany.com instead of company.com
- Display name spoofing, for example "Jane Smith - CEO"
- Sudden requests to bypass approval workflows
- Payment or bank detail changes sent only by email
- "I'm in a meeting" or "can't talk now" language to avoid voice verification

For Microsoft 365 administrators, useful hunting points include:

# Search unified audit logs for inbox rule creation
Search-UnifiedAuditLog -StartDate 07/24/2026 -EndDate 07/31/2026 -Operations New-InboxRule,Set-InboxRule

# Check recent successful logins and suspicious client apps
Get-AdminAuditLogConfig

For Google Workspace, review:

- Suspicious login alerts
- Forwarding rule creation
- OAuth app grants
- Unusual mailbox delegation

When you’ll encounter it

Most teams do not encounter BEC as a single dramatic event. They encounter it as a normal-looking request arriving during a busy workday.

You are most likely to see BEC when:

• Finance teams process invoices or wire transfers
• Payroll or HR handles employee data and bank details
• Executives travel frequently and delegate by email
• Procurement teams work with many vendors and payment updates
• Legal, real estate, construction, and healthcare workflows involve high-value transactions
• Small and midsize businesses operate with informal approval chains

In practice, BEC often appears during moments of friction:

• End-of-quarter payments
• Last-minute vendor changes
• Mergers or confidential projects
• Staff absences or executive travel
• Seasonal volume spikes
• New employee onboarding

For defenders, the key point is that BEC is as much a process security issue as an email security issue. Secure email gateways can block some spoofing and phishing, but they will not stop every well-written fraud attempt, especially if it comes from a compromised internal or partner account.

That is why practical defenses focus on verification and workflow controls:

• Require out-of-band verification for payment changes
• Ban approval-by-email alone for high-risk transactions
• Add dual authorization for wires and payroll changes
• Flag external senders clearly
• Monitor forwarding rules and impossible-travel logins
• Train staff to treat urgency and secrecy as attack indicators

Technical Notes

Examples of policy controls that reduce BEC risk:

Payment control:
- No bank account change is accepted from email alone
- Call a known phone number from the vendor master record
- Require second approver for any beneficiary change

Identity control:
- Enforce MFA for all email accounts
- Disable legacy authentication
- Alert on mailbox auto-forwarding
- Review delegated mailbox permissions regularly

Example warning banner:

CAUTION: This email originated outside the organization.
Do not trust payment changes, password resets, or document requests without verification.

Related terms

BEC overlaps with several other security and fraud terms, but they are not identical.

• Phishing: A broad category of deceptive messages that try to steal credentials, deliver malware, or trick users. BEC is a subtype of phishing focused on business processes and fraud.
• Spear phishing: Targeted phishing aimed at a specific person or team. Many BEC campaigns are spear phishing because they are personalized.
• Whaling: Phishing aimed at senior executives or high-value targets. Executive impersonation BEC often gets described this way.
• Email spoofing: Forging sender information to make a message appear legitimate. Spoofing is one delivery method for BEC, but not the whole attack.
• Account takeover: Unauthorized access to a real email account. This is one of the most dangerous BEC enablers because messages come from a trusted mailbox.
• Invoice fraud: A common BEC scenario where bank details on a supplier payment are changed.
• Social engineering: Psychological manipulation used to influence someone into taking an action. This is the core mechanism behind BEC.
• Vendor email compromise: A related term sometimes used when a supplier’s real mailbox is compromised and then used to redirect payments.

Why it matters in practice

BEC matters because it exploits a gap between technical controls and human workflows. The attacker does not need ransomware or an exploit chain if they can get one employee to believe a fake payment request.

For practitioners, the definition that matters most is this: BEC is fraudulent business process manipulation conducted through trusted communication channels, usually email. If you protect only the inbox and not the approval process, you are still exposed.

The practical response is straightforward:

1. Harden email identities with MFA and anti-spoofing controls like SPF, DKIM, and DMARC.
2. Monitor for account takeover indicators such as forwarding rules, odd logins, and unusual mailbox access.
3. Add non-email verification for payments, payroll changes, and sensitive data requests.
4. Train employees to pause on urgency, secrecy, and process exceptions.

If a request involves money, credentials, tax records, or bank changes, assume BEC is possible until verified through a second channel.

For more information on cybersecurity best practices, check out our articles on what is measured boot and patch management best practices.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.