The Anatomy of a Business Email Compromise (BEC) Attack
Most business owners have heard of “phishing.” Fewer have heard of “business email compromise,” even though it’s the single most expensive type of cyber attack against small businesses. The FBI consistently ranks BEC as the costliest category of cybercrime, with reported losses in the billions of dollars per year — and the actual losses are much higher because most incidents go unreported.
Here’s what makes BEC particularly dangerous: it doesn’t usually involve malware, ransomware, or any obvious computer compromise. It’s a fraud scheme that uses email as the delivery mechanism. The victims often don’t realize they’ve been hit until weeks after the money is gone.
Let’s walk through exactly how a BEC attack unfolds, why small businesses are particularly vulnerable, and the specific controls that actually stop it.
What "BEC" really means
Business email compromise is a fraud where an attacker impersonates a trusted party — usually an executive, a vendor, or a known business contact — to trick someone in your business into doing something that benefits the attacker. The most common outcome is a fraudulent wire transfer. But BEC attacks can also redirect payments, steal sensitive data, change banking information, or compromise additional accounts for follow-on attacks.
The attacker’s goal is to get a real human in your business to take a specific action under false pretenses. The “compromise” might or might not involve actually breaching an email account; sometimes it’s a spoofed email from outside, sometimes it’s a real takeover of an account inside.
Either way, the attack succeeds based on social engineering, not technical exploitation. Which is exactly why technical defenses alone don’t stop it.
How a BEC attack typically unfolds
Let’s walk through a realistic scenario. The details vary, but the pattern is consistent.
Week 1: Reconnaissance. The attacker researches your business. They check LinkedIn to learn who works there, what their roles are, and who reports to whom. They look at your website to understand what you do. They might find press releases announcing deals, projects, or expansions. They might find financial information in your public filings if you have any. They might monitor public posts on social media.
By the end of this phase, the attacker knows: who your CEO is, who your bookkeeper or controller is, what vendors you work with (often disclosed in press releases or job postings), what your typical business looks like.
Week 2-3: Initial intrusion (sometimes). Sometimes the attacker takes the further step of compromising an email account. They might send a phishing email to a specific employee, get them to enter credentials on a fake page, and gain access to that person’s inbox.
Once inside an inbox, they don’t immediately make demands. They watch. They read recent emails. They learn the writing style of the person. They identify ongoing conversations, pending invoices, and active negotiations. They learn who that person talks to and about what.
Sometimes they set up email forwarding rules so that copies of incoming emails get sent to an external attacker-controlled address. Sometimes they set up rules to hide their own activity (deleting confirmation emails, hiding sent messages).
Week 4: The setup. The attacker waits for the right moment. The right moment is usually one of these:
- A real wire transfer or payment is about to happen, and they can intercept and redirect it
- A vendor is sending an invoice that they can spoof with new banking information
- An executive is about to be unreachable (traveling, on vacation, in a long meeting)
- A natural business event creates urgency around a payment
Week 5: The attack. The actual fraud message goes out. It might be:
“Hi Sarah — I’m in back-to-back meetings all day and need a wire sent for the [real project name] before close of business. Can you handle it? Here are the details: [bank account controlled by attacker]. Don’t reply to this email, my phone’s dead, I’ll check back when I can. — [CEO name]”
Or:
“Hi [your name] — As we discussed, please update our wire instructions for our remaining invoices. Effective immediately, please remit to: [attacker bank]. Confirming receipt: [forged signature]. — [real vendor name]”
Or:
“Following up on the email below from [CEO] — we need to confirm the routing details. Could you call this number: [attacker phone] and read back the wire details so we can verify?”
The messages are believable because the attacker has done the research. They reference real names, real projects, real ongoing work. They mimic the tone of real emails the writer has actually sent. They specifically frame the situation to bypass verification — “phone is dead,” “in meetings,” “this is time sensitive.”
Week 6: The money goes. The wire transfer is sent. The bank account is real, but it’s controlled by the attacker. Within hours, the funds are moved to other accounts, often overseas. By the time anyone realizes what happened, the money is essentially impossible to recover.
The victim business often doesn’t realize the attack happened until days or weeks later, when the real vendor calls about a missing payment or the real CEO returns from vacation and asks about a transaction they don’t recognize.
Why small businesses are particularly vulnerable
BEC attackers love small businesses for several reasons.
Fewer layers of verification. Larger organizations typically have multiple sign-offs on significant payments. Small businesses often have one or two people handling the entire process, which means fewer chances to catch a fraudulent request.
Tighter personal relationships. When the bookkeeper has worked closely with the owner for ten years, the bookkeeper trusts the owner. That trust is exactly what attackers exploit by impersonating the owner.
Less robust security controls. Most small businesses don’t have email authentication properly configured (SPF, DKIM, DMARC), making spoofing easier. They often don’t have advanced email security tools. They rarely have monitoring that would catch unusual outbound communication patterns.
Higher impact per incident. A $50,000 fraudulent wire is annoying for a Fortune 500 company. It can be a serious blow to a 25-person business.
Less likelihood of reporting. Small businesses often don’t report BEC incidents, both because of embarrassment and because they don’t think reporting will help. This means attackers face less downside risk targeting small businesses than they would targeting larger organizations.
What actually stops BEC
Technical controls help, but they aren’t sufficient. The defenses that actually stop BEC are a combination of technical and procedural.
Multi-factor authentication on every email account. This stops most account takeover attacks before they start. If an attacker phishes a credential and tries to log in, MFA blocks them.
Email authentication: SPF, DKIM, and DMARC. These are technical email standards that make it much harder for attackers to spoof your domain. A properly configured DMARC policy can reject spoofed emails before they reach the recipient. (We’ll dive deeper on email authentication in an upcoming post.)
Advanced email threat protection. Tools like OpenText Email Threat Protection that look specifically for impersonation patterns, lookalike domains, and BEC indicators — and flag or block them before they reach inboxes.
Verification protocols for financial requests. This is the most important one. Any request involving money or sensitive data — especially anything urgent or unusual — must be verified through a known, separate channel before action is taken. The phone number to call is the one on file, not the one in the email. This single rule blocks the majority of successful BEC attacks.
Two-person approval for significant transactions. Wire transfers over a certain dollar threshold require sign-off from a second person. Adding a second human eye dramatically reduces successful fraud.
Documented vendor onboarding and change processes. New vendor banking information requires verification through known contacts. Changes to existing vendor banking information require call-backs to existing contact numbers, not to numbers provided in the change request.
Awareness training that focuses specifically on BEC. Most security awareness training covers general phishing. BEC-specific training — what does an executive impersonation attack look like, what does vendor fraud look like, what are the red flags — is dramatically more effective.
Monitoring for unusual mailbox rules. A common attacker tactic is to set up email forwarding or filtering rules in a compromised mailbox. Monitoring for these rules being created (and alerting on it) catches account takeovers in progress.
What to do if you suspect a BEC attempt
If you receive a suspicious request, or worse, suspect a successful BEC has occurred, time matters enormously.
If you’re suspicious but haven’t acted yet:
- Don’t act on the request via email. 2. Call the supposed sender at a known number (not the one in the email). 3. Report the email to your IT provider. 4. If it’s a phishing attempt, the email should be analyzed and the team alerted.
If you’ve already sent money or sensitive data:
- Call your bank immediately. In some cases, very quick action can reverse a wire transfer. 2. Call your IT provider — there may be an active compromise that needs containment. 3. Report to local law enforcement and to the FBI’s Internet Crime Complaint Center (IC3) at ic3.gov. 4. If sensitive employee or customer data was exposed, consult your attorney about notification requirements. 5. Consider this an incident response situation — proper investigation may reveal additional compromised accounts or ongoing access.
What to do this week
If BEC defense hasn’t been an explicit focus for your business, here’s what’s worth doing in the next week:
- Write down your verification protocol. Specifically for financial requests, vendor changes, and unusual requests “from the boss.” Tape it to the wall where bills are paid. Make sure everyone who could be a target knows the protocol — and knows that the protocol applies even when the request appears to be from senior leadership.
- Make sure MFA is on every email account. No exceptions, especially for owners, executives, finance, and HR.
- Talk to your IT provider about email authentication and BEC-specific email protection. If SPF, DKIM, and DMARC aren’t properly configured for your domain — and at most small businesses, they aren’t — fixing that significantly reduces your spoofing risk.
If you’d like help working through any of this, that’s exactly the kind of thing we set up for clients. The combination of the right technical controls and the right business processes makes the difference between “occasionally a successful BEC happens” and “BEC attempts hit but nothing gets through.” The cost of doing this work is small. The cost of one successful BEC is significant. Worth a short conversation.
