Business email compromise
Someone posing as a boss or a vendor talks your team into sending money or data.
Business email compromise (BEC) is fraud that uses email — and often a follow-up call or chat — to impersonate an executive, a colleague, or a supplier, then trick someone into paying a new account, changing bank details, or sending sensitive files. It is a process failure as much as a technology failure.
What it looks like
Sometimes the attacker only spoofs a display name, or registers a lookalike domain (your-company.co next to your-company.com). Sometimes they have actually broken into a real mailbox and write from the inside, quoting real threads. AI can help them match tone and work faster, but the core move is social: authority plus urgency plus a reason not to use the usual process.
- A “CEO” emails finance to pay a new partner today, and follow up only with them.
- A “vendor” sends updated bank details, perhaps after a genuine-looking invoice thread.
- A “colleague” asks for employee tax forms, ID scans, or a password reset while the real person is travelling.
Why filters are not enough
A well-written request from a lookalike domain, or from a mailbox that is already compromised, can pass through ordinary spam filters. The defence that actually works is a payment and identity habit: you confirm changes through a channel you already trust, and no one person can quietly change the destination of money.
Build a boring, reliable process
Write this down. Practice it. Make it apply to the founder as much as to everyone else — attackers like to impersonate the person nobody wants to second-guess.
- No new payee and no change to bank details without a second check on a known number or in person. Not on the phone number in the email.
- Dual approval for payments over a threshold you choose, including when the founder is the one “asking.”
- Turn on MFA on every mailbox that can authorise money or see customer data.
- Watch for forwarding rules, unusual inbox rules, and login alerts on executive mailboxes.
- If a mailbox is compromised, assume threads in it are tainted. Warn vendors and staff on a different channel.
- DeepfakesA fake video or photo can put words — or a face — where they never were.
- Voice-clone scamsA short clip of your voice can be enough for someone to call “as you.”
- AI phishingThe typo is no longer a tell. The message can sound exactly like someone you work with.
- Data scrapingPublic pages and leaky forms can be vacuumed up and reused against you later.