Business email compromise, often shortened to BEC, is a form of fraud in which an attacker impersonates or takes control of a trusted email identity to manipulate an employee into sending money, changing payment details or disclosing sensitive information. Reducing the risk requires more than a spam filter: organizations need secure identities, reliable payment-verification procedures and employees who know when to pause and escalate.
The most important points
Verify payment, banking and payroll changes through a separate trusted channel before acting.
Protect email identities with multi-factor authentication, conditional access and controlled privileges.
Combine technical email security with employee procedures, escalation rules and a tested response plan.
What is business email compromise?
Business email compromise is a targeted social-engineering attack built around trust. Instead of relying only on malicious attachments or obvious fake websites, the attacker creates a believable business request using the name, address or writing style of an executive, employee, supplier, customer or professional adviser.
In some cases, the attacker registers a look-alike domain or changes the display name shown in the recipient's inbox. In more serious cases, the attacker gains access to a real mailbox, studies previous conversations and inserts fraudulent instructions into an existing email thread. Because the message appears to come from a trusted source and refers to a legitimate transaction, it can be difficult to identify without a verification process.
Common forms of business email compromise
The exact message changes, but the attack usually attempts to create urgency, secrecy or pressure around a financial or information-related request.
- Invoice fraud: altered banking information is sent for a legitimate supplier payment.
- Executive impersonation: an employee receives an urgent request to purchase gift cards or initiate a transfer.
- Payroll diversion: an attacker requests a change to an employee's direct-deposit account.
- Supplier compromise: a real vendor mailbox is used to redirect payments across multiple customers.
- Information theft: tax records, employee details, contracts or customer information are requested for future fraud.
When a mailbox has been compromised, an attacker can read earlier messages and wait for the right moment to intervene. Banking, payment, payroll and sensitive-data changes should therefore be verified through a separate, trusted communication channel.
Why small businesses are attractive targets
Small and mid-sized organizations often process meaningful payments but operate with lean finance and IT teams. Employees may handle several responsibilities, approval procedures may be informal and a request from a senior leader or long-standing supplier can move quickly. Attackers exploit this combination of trust, speed and limited separation of duties.
Trust and urgency can work against the business
A request that appears to come from an executive or important customer can create pressure to respond immediately. Messages may refer to confidentiality, a delayed invoice, a closing deadline or a supplier relationship. The attacker is trying to prevent the recipient from pausing long enough to verify the request.
Cloud email accounts provide valuable business context
If an attacker gains access to a Microsoft 365 or other cloud mailbox, they may obtain contact information, invoices, signatures, travel schedules and previous approval patterns. Strong identity protection and sign-in monitoring are therefore central to reducing BEC risk.
Business email compromise warning signs
No single sign proves that a message is fraudulent. The risk rises when several indicators appear together, especially when the message involves money, account changes or sensitive information.
| Warning sign | Why it is concerning | Recommended action |
|---|---|---|
| New banking or payment instructions | Payment-detail changes are a common objective of BEC attacks. | Call a previously verified contact using a known phone number. |
| Unusual urgency or secrecy | Pressure reduces the likelihood that the employee will follow normal checks. | Pause the transaction and escalate through the approved process. |
| Unexpected change in tone or wording | The attacker may be imitating the sender without fully understanding normal communication patterns. | Review the sender address and verify through a separate channel. |
| Reply-to address differs from the sender | Replies may be redirected to an attacker-controlled mailbox. | Inspect the complete email address before responding. |
| Request bypasses normal approval | Attackers frequently claim an exception is necessary because of timing or confidentiality. | Do not bypass dual approval, documented limits or vendor-change procedures. |
How to reduce the risk of business email compromise
Effective protection combines technical safeguards with financial controls and employee decision-making. The goal is to make account takeover more difficult and prevent a convincing email from becoming an unauthorized transaction.
Secure email identities
Require multi-factor authentication, restrict legacy authentication, review privileged roles and use conditional access policies appropriate to the organization.
Strengthen payment verification
Require separate-channel confirmation for new vendors, banking changes, payroll changes and unusual payments. Preserve dual approval for high-risk transactions.
Protect email and the company domain
Configure anti-phishing protections and maintain SPF, DKIM and DMARC. These controls help reduce spoofing, although they do not replace protection against compromised real accounts.
Prepare employees and response teams
Train employees using realistic scenarios, provide a simple reporting channel and document the steps to follow when a suspicious request or fraudulent payment is discovered.
What to do next
Common mistakes that leave businesses exposed
Organizations often focus on whether a message looks suspicious while overlooking the process that follows. A highly convincing email can still be stopped when employees are required to verify high-risk changes and approvals cannot be bypassed.
- Assuming that multi-factor authentication eliminates all email fraud.
- Allowing payment-detail changes to be approved entirely by email.
- Using the phone number supplied in the suspicious message for verification.
- Failing to monitor forwarding rules, delegated access and unusual sign-ins.
- Waiting until an incident occurs before defining escalation contacts.
If the mailbox or thread has been compromised, the attacker may answer the verification message. Use a previously known phone number, approved internal channel or independently verified contact.
Strengthen email security and financial verification before an incident occurs.
Citrine helps Canadian organizations review Microsoft 365, identity, email security and business procedures, then prioritize the controls that will reduce account-compromise and payment-fraud risk.
Questions readers commonly ask
Is business email compromise the same as phishing? +
BEC is a form of social engineering that often uses phishing, impersonation or a compromised mailbox. It is typically more targeted and focused on financial transactions, account changes or sensitive business information.
Will multi-factor authentication stop business email compromise? +
Multi-factor authentication significantly improves account security, but it does not stop every form of impersonation, social engineering or session theft. It should be combined with conditional access, email protection and payment verification procedures.
What should we do if a fraudulent payment has been sent? +
Contact the financial institution immediately, follow the organization's incident-response process, preserve relevant email and transaction evidence, secure affected accounts and notify appropriate internal and external stakeholders.
How can Microsoft 365 be configured to reduce BEC risk? +
Important controls include multi-factor authentication, conditional access, restricted administrative privileges, anti-phishing policies, mailbox-rule monitoring, safe attachment and link protections, audit logging and regular review of risky sign-ins.
Conclusion
Business email compromise succeeds by turning a trusted identity and a believable request into an urgent business decision. Technology can reduce the chance of account takeover and identify suspicious activity, but financial controls and employee verification remain essential.
The most effective next step is to review identity security, email protection, payment-change procedures and incident readiness as one connected control environment. A small number of consistently followed safeguards can stop a convincing email from becoming a costly transaction.
Citrine Technologies
Citrine Technologies provides structured managed IT, cybersecurity, cloud and governance services for Canadian organizations.