Business Email Compromise: Patterns and Defences

Published October 23, 2026 · Last reviewed October 23, 2026

Business email compromise (BEC) is fraud that uses an ordinary email, from a spoofed, look-alike or hijacked account, to get someone to send money or data. It needs no malware. The control that stops it is not a filter but a rule: no payment, bank-detail change or gift-card request is acted on from email alone. Verify by a second channel, using contact details you already hold.

The four patterns to recognise

Most BEC cases fit one of four shapes. Knowing them lets a tired employee recognise the story, even when the email itself looks flawless.

Invoice redirect. A real supplier invoice, or a copy of one, arrives with “updated” bank details. The sender is either a look-alike address or the supplier’s own hijacked mailbox.
Payroll diversion. A message that appears to come from an employee asks HR or payroll to change the bank account for the next pay run.
Executive impersonation. A message that appears to come from the owner or a director asks for an urgent transfer, a gift-card purchase or a favour “before the meeting”, and asks you not to call.
Thread hijacking. The attacker has read a real conversation in a compromised mailbox and replies inside it at the moment a payment is due. Because the thread is genuine, trust is high.

Signs worth stopping for

Any one of these is a reason to pause, and two together is a reason to call: urgency or secrecy; a change to how you are paid or pay; a sender address that differs by one character from the real one, or a display name that does not match the address behind it; a Reply-To address that differs from the sender; a request that skips the normal approval; and a new tone or sign-off from a familiar person.

Controls, in priority order

Action: Write a one-page payment rule and sign it off at owner level. It should say that any new payee, changed bank detail or off-cycle payment is confirmed by a call to a number already on file, and approved by a second person. The detailed procedure is in payment-change verification.
Why it helps: BEC succeeds because one person is trusted to act on one message. A second person and a second channel break that chain for every pattern above.
Verification: Ask the person who pays invoices what they would do with a changed bank detail. If the answer is not “call the number on file”, the rule is not in use yet.
Fallback if delayed: Until the rule is adopted, hold any payment to a new or changed account for one business day and have the owner approve it by phone.

Action: Turn on impersonation and external-sender warnings. In Microsoft 365 this is in the Microsoft Defender portal under the anti-phishing policy (user and domain impersonation protection, and first-contact safety tips); in Google Workspace look in the Admin console for the Gmail safety settings. Menu names move between plans, so search the admin console for “anti-phishing” or “safety”. Profile A Profile B/C delta: in Google Workspace the equivalent controls live in the Gmail safety settings of the Admin console.
Why it helps: Look-alike names and domains are the cheapest attack. A visible warning on first-time or external senders gives staff a reason to look twice.
Verification: Send a test message from a personal address with the display name of your owner. It should arrive with an external or impersonation warning.
Fallback if delayed: Add a mail-flow rule that prepends “[External]” to the subject of mail from outside the organisation.

Action: Protect the mailboxes that hold the trust: owner, finance, payroll and executive assistants. Require multi-factor authentication, review their sign-ins weekly, and read the guide on mailbox rules for the check that finds hidden forwarding.
Why it helps: Thread hijacking and supplier-side fraud both start with a stolen mailbox login. Protecting the mailbox removes the attacker’s best material.
Verification: In the admin sign-in log, filter by these users and confirm no sign-ins from countries or devices you do not expect.
Fallback if delayed: If MFA cannot be enforced this week, at minimum change these passwords to long unique ones held in a password manager.

Common failure mode

The payment rule is written but the call-back goes to the number in the email, or the person who checks is the same person who was asked to pay. A signature block, a “new number” or a Reply-To address is under the attacker’s control. The number must come from your own records, from before the request arrived.

If money has already moved

Call your bank at once and ask it to attempt a recall. Then report the loss: in the United States to the FBI Internet Crime Complaint Center, and in Canada to the Canadian Anti-Fraud Centre and the Canadian Centre for Cyber Security. Time matters, so call first and write the report afterward. Then treat the mailbox that sent or received the request as compromised.

How it works

BEC works on process, not technology. The attacker studies who approves payments, learns how invoices are phrased, and then places one message at the point where a person is both busy and trusted. Even a perfect spoof is only the opening move: the money moves because the victim makes the payment.

Two features make it hard to catch after the fact. First, the transfer is a legitimate action by a legitimate employee, so there is nothing for antivirus to flag. Second, recovery depends on speed, because funds are moved on from the receiving account quickly. That is why the defence is a verification habit placed before the payment, plus a fast reporting path afterward. Email authentication (see SPF, DKIM and DMARC) stops others from sending as your exact domain, but it does not stop look-alike domains or a real supplier’s hijacked mailbox, so it supports the rule rather than replacing it.

Worked example

Suppose, as a hypothetical, a 40-person distributor pays a long-standing freight supplier on the 25th of each month. On the 22nd, a message arrives in the usual thread: “Our bank has changed, please use the attached details from the next invoice.” The address looks right; a closer look shows the domain has an extra letter.

The accounts clerk follows the written rule. She does not reply to the thread; she opens the supplier record in the accounting system, calls the phone number saved there, and asks the contact whether the bank has changed. The contact says no. The clerk forwards the message to the owner and uses the report button, and the mail-admin blocks the look-alike domain. The point is the sequence: stop, use a number already on file, a second person informed, and report. The scenario and names are invented for illustration, and no figures are given because none are claimed.

Frequently asked questions

What is business email compromise?

Fraud in which an attacker uses a spoofed, look-alike or hijacked business email account to trick staff into sending money or sensitive data, most often by changing payment details on a real invoice or pay run.

How is BEC different from ordinary phishing?

Ordinary phishing aims to steal a login or install malware. BEC usually contains no link or attachment: the message simply asks a person to do something that looks normal, such as pay an invoice.

Can email authentication stop BEC?

It stops others from sending mail that passes as your exact domain, but it cannot stop look-alike domains or messages sent from a genuinely compromised account. Use it alongside the payment-verification rule.

Who should I report a BEC loss to?

Contact your bank first to ask for a recall. In the United States, report to the FBI Internet Crime Complaint Center. In Canada, report to the Canadian Anti-Fraud Centre and the Canadian Centre for Cyber Security.

Which staff are most likely to be targeted?

People who can move money or change payment details, such as finance, payroll and the owner's assistant, and people who are publicly named on the company website or on social media.

Want checks like this in your inbox?

The briefing is published on this site every morning. The email edition is not sending yet — leave your address and you’ll be among the first told when it starts. Nothing is sent in the meantime.