Resource · 9 min read · Wade Stromer
Business email compromise: how it happens and how to stop it
How BEC attacks work, what to do in the first hour, and controls that actually reduce wire-fraud risk—without security theater.
What business email compromise actually is
BEC is fraud that uses email (and sometimes phone follow-ups) to trick people into sending money or data. Attackers impersonate executives, vendors, or trusted partners. The message is boring on purpose—an invoice resend, a payroll update, a rush wire before close.
Losses are real because the process looked normal. That is why generic “don’t click links” training alone fails finance teams under deadline pressure.
Common patterns
Vendor invoice redirect: “Our bank changed—here is the new ACH info.” CEO fraud: “I am traveling—wire this today, keep it confidential.” Payroll diversion: “Please update my direct deposit.” Account takeover: attacker reads mail for weeks, then inserts wire instructions into an existing thread.
Look-alike domains and mailbox rules that auto-forward or hide replies extend the attack window. Assume compromise if forwarding rules appear that nobody remembers creating.
Controls that earn their place
Out-of-band verification for any wire or bank change—call a known number, not the one in the email. Dual control on payments over a threshold. MFA on all mail and admin accounts; disable legacy auth. Monitor for new inbox rules and impossible travel alerts.
Train finance and AP on thread hijacks, not cartoon phishing examples. Run a tabletop: “It is 4 p.m. Friday and AP got this message—what do we do?”
If you are responding now
Contain accounts, reset credentials with MFA, review mail flow and rules, and preserve headers/logs. Notify your bank and insurer per your policy. Communicate internally with a single source of truth so rumors do not spread.
After containment, harden: payment verification playbooks, vendor master data ownership, and periodic access reviews—not just password resets.
Next step
Want a tailored read on your situation? Start with the cybersecurity diagnostic—free, under five minutes.
Related: BEC response work · Security consulting
FAQ
- Is BEC the same as phishing?
- Phishing is often the entry point, but BEC is the outcome: fraudulent wire instructions, invoice redirects, or payroll changes executed because someone trusted a message that looked normal.
- Will MFA stop BEC?
- MFA stops many account takeover paths—it is essential. It does not stop look-alike domains, thread hijacks after compromise, or finance processes that change wire details from email alone.
- What is the first call after suspected BEC?
- Contain: disable compromised accounts, revoke active sessions, and alert finance to halt outbound wires. Then preserve logs and engage incident response—speed beats perfection in the first hour.