Business Email Compromise (BEC): How It Works & Defense

Business Email Compromise (BEC) is a scam where an attacker impersonates a trusted executive, vendor, or employee over email to trick a business into wiring money or sensitive data to an account the attacker controls. Unlike ransomware or malware attacks, BEC often uses no malicious code at all — just a convincing message, a spoofed or hijacked email address, and a request that looks routine. The FBI's Internet Crime Complaint Center (IC3) has repeatedly named BEC among the costliest categories of cybercrime it tracks, ahead of ransomware in reported dollar losses. For Indian businesses running international vendor payments, payroll, or executive travel approvals over email, BEC is not a theoretical risk — it is a process failure waiting to be exploited.

If you run finance, IT, or leadership for an SMB, understanding how BEC actually works — and where your approval workflow has a gap — matters more than any single security tool.

What Is Business Email Compromise?

BEC is a social-engineering fraud, not a technical exploit. The attacker's goal is to get someone with payment authority to voluntarily move money or share credentials, by making a fraudulent request appear to come from someone they trust — a CEO, a CFO, a known vendor, or a colleague in finance. The attack succeeds when the target's judgment is compromised by urgency, authority, and familiarity, not when a firewall is breached.

This is why BEC evades most conventional security controls. Antivirus doesn't flag a well-written email with no attachment. A firewall doesn't block a legitimate wire transfer initiated by an authorized employee. The exploit is the business process itself — an email that looks routine enough to skip verification.

The Four Main BEC Schemes

CEO fraud (executive impersonation). The attacker spoofs or hijacks a senior executive's email — often the CEO or CFO — and sends an urgent, confidential request to finance or accounts payable to wire funds immediately, frequently claiming to be traveling and unreachable by phone. The urgency-plus-authority combination is designed to bypass normal scrutiny.

Vendor / supplier invoice fraud. The attacker compromises or spoofs a genuine vendor's email thread — sometimes after reading real invoice history from a hacked mailbox — and sends an "updated bank details" notice ahead of the next payment. Because the invoice amount and vendor name are real, this variant is especially hard to catch without an independent verification step.

Payroll diversion. The attacker impersonates an employee (often via a lookalike or spoofed personal address) and asks HR or payroll to update their bank account details before the next payroll run. Salaries for that cycle land in the attacker's account instead. This scheme scales poorly for a single large payout but is common because payroll changes often get lighter scrutiny than large one-off wires.

Account takeover (email account compromise). Rather than spoofing an email, the attacker gains real access to a mailbox — via phishing, credential stuffing, or a weak/reused password with no MFA — and sends fraudulent requests from the genuine account. This variant is hardest to detect because the email truly originates from the real inbox, with a real signature and real historical thread context.

Why BEC Is So Costly — and So Effective

BEC is consistently one of the highest-loss cybercrime categories the FBI IC3 tracks, because a single successful wire fraud can move a large sum in one transaction, with no ransomware payload and often no way to reverse the transfer once funds clear through intermediary "money mule" accounts. Verizon's Data Breach Investigations Report (DBIR) has also repeatedly flagged the human element — pretexting and social engineering over technical exploitation — as a leading breach factor, and BEC is the purest expression of that pattern: no code, just a convincing message and a broken verification step.

The psychology attackers exploit is consistent across variants:

1. Authority. People are conditioned not to question a request that appears to come from a CEO or a long-standing vendor.
2. Urgency. "Wire this before end of day" or "confidential, don't discuss with anyone else" pressures the target to skip the usual checks.
3. Familiarity. Real invoice numbers, real names, real prior thread context (especially in mailbox takeover) make the request look routine rather than suspicious.
4. Isolation. Requests to keep the matter confidential or to avoid calling the requester directly cut off the one verification channel that would catch the fraud.

Email Authentication: SPF, DKIM, and DMARC

Domain spoofing — where an attacker sends mail that appears to come from your own domain, or a near-identical lookalike — is defensible with email authentication standards. These don't stop mailbox takeover, but they close the spoofing door, a large share of BEC attempts against Indian SMBs that haven't configured them.

Practical Defenses Beyond Email Authentication

Email authentication stops domain spoofing, but the majority of BEC losses come from process failures that no DNS record can fix. The controls that actually stop wire fraud sit in your payment workflow, not your inbox.

Out-of-band verification for payment changes. Any request to change bank account details — vendor, payroll, or executive-initiated — must be confirmed through a channel independent of email: a phone call to a number already on file (never a number provided in the request itself), or a pre-agreed verification code with the vendor.

Dual approval on wire transfers above a threshold. No single individual should be able to both initiate and approve a large payment. A second approver, using a separate verification step, catches what a rushed first reviewer misses.

MFA on every mailbox, especially finance and executive accounts. Mailbox takeover is the hardest BEC variant to catch after the fact — the cheapest prevention is making the account takeover itself much harder with multi-factor authentication.

Slow down urgency-flagged requests. Any email invoking confidentiality, urgency, or "don't call, just email" instructions should trigger extra scrutiny, not less. Train staff that these are attacker signals, not exceptions to the process.

Domain monitoring for lookalikes. Register close variants of your own domain where feasible, and monitor for newly registered lookalike domains that could impersonate your organization to vendors or customers.

Staff Training That Actually Reduces BEC Risk

Generic phishing-awareness training rarely prevents BEC, because BEC emails often contain no malicious link or attachment for a spam filter or a trained eye to flag. Effective training instead focuses on one pattern: urgency plus authority plus a payment or credential request equals mandatory out-of-band verification, no exceptions — including for the actual CEO, who should expect and welcome the callback.

Finance and payroll staff need to know that an email request alone is never sufficient authorization for a bank-detail change, regardless of how senior the apparent sender or how routine the invoice looks. This one rule, consistently enforced, defeats the majority of BEC attempts because it removes email as a sufficient trust anchor.

Reported Share of BEC Scheme Types

Among the four common BEC variants, invoice/vendor fraud and CEO-style executive impersonation are the most frequently reported patterns in industry incident data, with payroll diversion and account takeover following. The exact mix varies by organization size and sector, so treat this as a general prioritization guide rather than a precise measurement for any single company.

Bachao.AI, built by Dhisattva AI Pvt Ltd, helps Indian SMBs continuously assess external-facing exposure — including weak email and domain hygiene that makes spoofing-based BEC easier — though BEC defense itself is primarily a people-and-process discipline, not a scanning problem.

Frequently Asked Questions

Sources: FBI Internet Crime Complaint Center (IC3) annual reports on Business Email Compromise (ic3.gov), Verizon Data Breach Investigations Report (verizon.com/dbir), CERT-In advisories on email-based fraud (cert-in.org.in).

Worried about how exposed your domain and external-facing systems are to impersonation and spoofing? Book a free VAPT scan.