Business email compromise (BEC) is a scam where attackers impersonate a trusted person, often an executive or supplier, to trick staff into transferring money or sensitive information. It relies on deception rather than malware, which makes it hard to catch technically. Protecting your business means multi-factor authentication, verification processes for payments, staff awareness, and monitoring for compromised accounts.
What business email compromise is
Business email compromise, or BEC, is a form of fraud in which an attacker impersonates someone a target trusts, a company executive, a supplier, a colleague, to deceive them into doing something harmful, usually transferring money or handing over sensitive information. Unlike attacks that rely on malware or technical exploits, BEC relies on deception. The attacker manipulates a person, using authority, urgency and trust, rather than breaking any technology.
That is what makes BEC both effective and difficult to defend against. There may be no malicious attachment or link for a filter to catch, just a convincing message from what appears to be a trusted person. Because it targets human judgement rather than systems, BEC bypasses many technical defences, and it has become one of the most financially damaging forms of cybercrime.
How BEC attacks work
BEC attacks follow a few common patterns. In executive impersonation, the attacker poses as a senior leader and instructs a staff member, often in finance, to make an urgent payment. In supplier or invoice fraud, the attacker impersonates a supplier and requests that payment be sent to a new, attacker-controlled account. In other variations, the attacker seeks sensitive information rather than money.
Often the attacker does research first, learning about the organisation, its people and its processes, so the deception is convincing. Sometimes they compromise a real email account to send their messages from a genuine address, which makes the fraud even harder to spot. The common thread is a request that seems to come from a trusted source, timed and worded to pressure the target into acting quickly, before they stop to verify.
Why BEC is so hard to catch
BEC is difficult to defend against precisely because it exploits trust and human judgement rather than technology. A message impersonating your CEO, asking for an urgent payment, may contain nothing technically malicious, no attachment, no link, nothing for a security tool to flag. It relies entirely on the recipient believing it and acting on it.
The use of authority and urgency is deliberate. People are inclined to act quickly on a request that appears to come from a senior leader, and urgency discourages the pause that would reveal the fraud. When the attacker has compromised a real account, or crafted a convincing impersonation, the request can be very hard to distinguish from a genuine one. This is why BEC succeeds even at security-aware organisations, and why defending against it requires more than technical controls.
How to protect your business
Because BEC targets people and processes, defending against it combines several measures:
- Multi-factor authentication, so email accounts are harder to compromise in the first place
- Verification processes for payments and sensitive requests, confirming them through a separate, trusted channel
- Staff awareness, so people recognise the signs of BEC and feel able to question unusual requests
- Clear processes for changing payment details, so a request to redirect payment is always verified
- Monitoring for compromised accounts, so a hijacked email account is detected quickly
The single most effective defence is verification. If any request to transfer money or change payment details is always confirmed through a separate, trusted channel, a phone call to a known number, not a reply to the email, then even a convincing impersonation fails, because the fraudulent request cannot survive that check.
The importance of verification and culture
Two things deserve emphasis. First, verification processes are the practical heart of BEC defence. A simple, consistently applied rule, that payments and payment-detail changes are always verified independently, defeats the core of most BEC attacks. Making this a firm process, not an optional courtesy, is what protects the organisation even when a message is convincing.
Second, culture matters. Staff need to feel able to question an unusual request, even one that appears to come from a senior leader. BEC exploits the reluctance to challenge authority, so a culture where verifying a request is expected and encouraged, not seen as distrustful, removes the pressure the attacker relies on. Technology helps, but a verification-minded culture is what most reliably stops BEC.
Detecting and responding to compromise
Where an attacker has compromised a genuine email account to run their fraud, detection matters. Monitoring for signs of account compromise, unusual logins, unexpected activity, and for exposed credentials that could let an attacker in, helps catch a hijacked account before it is used for fraud. And having a clear response ready, for when a suspected BEC attempt or a compromised account is identified, limits the damage.
If you want help defending against business email compromise, from securing accounts to detecting compromise, our managed detection and response services watch for the signs, and our cyber incident response can help if an attempt succeeds.
For guidance on BEC, see the cyber.gov.au resources and the ACSC.
Frequently asked questions
What is business email compromise?
Business email compromise is a scam where an attacker impersonates a trusted person, often an executive or supplier, to trick staff into transferring money or sensitive information. It relies on deception rather than malware, which makes it hard to catch with technical tools alone.
How do BEC attacks work?
Common patterns include impersonating an executive to demand an urgent payment, impersonating a supplier to redirect payment to a new account, or seeking sensitive information. Attackers often research the organisation, and sometimes compromise a real account, to make the deception convincing.
Why is BEC hard to catch?
Because it exploits trust and human judgement rather than technology. A message impersonating a leader may contain nothing technically malicious for a filter to flag, relying entirely on the recipient believing it and acting quickly under apparent authority and urgency.
How do you protect against BEC?
Use multi-factor authentication, verify all payment and sensitive requests through a separate trusted channel, train staff to recognise and question unusual requests, set firm processes for changing payment details, and monitor for compromised accounts. Independent verification is the most effective defence.
