Business Email Compromise (BEC) is a type of cyber-enabled fraud in which criminals impersonate trusted individuals or use compromised email accounts to manipulate employees into transferring money, disclosing sensitive information or performing unauthorised actions. Attackers commonly pretend to be senior executives, suppliers, colleagues or professional advisers, using convincing messages that appear to originate from legitimate business relationships.
Unlike many cyber attacks that rely primarily on malicious software, Business Email Compromise frequently uses social engineering. Criminals exploit trust, urgency and established working relationships to persuade employees to bypass normal verification procedures. BEC attacks may involve fraudulent invoices, changes to supplier bank details, requests for confidential documents or instructions to make urgent payments.
For UK businesses, particularly financial services firms, legal practices and organisations handling client funds or sensitive information, BEC represents a significant cybersecurity and financial risk. Successful attacks can result in direct financial losses, compromised information, interrupted operations and damaged client relationships. Preventing BEC requires a combination of email security, identity protection, employee awareness and reliable business processes for verifying sensitive requests.
Why Business Email Compromise Is Important for Businesses
Email remains one of the most widely used communication channels for financial transactions, supplier relationships and internal business decisions. Employees routinely receive payment instructions, invoices, contract documents and confidential information through their inboxes.
Attackers exploit this dependence by creating messages that closely resemble legitimate correspondence. A fraudulent request may use a familiar company name, reference an existing project or appear within an ongoing email conversation.
These details can make the message difficult to recognise as suspicious.
Key Reasons BEC Is a Serious Business Risk Include:
- Direct Financial Losses: Employees may be manipulated into transferring funds to accounts controlled by criminals.
- Compromised Business Relationships: Attackers can impersonate suppliers, executives or trusted professional contacts.
- Exposure of Sensitive Information: Fraudulent requests may lead to disclosure of personal, financial or confidential business data.
- Limited Reliance on Malware: Many BEC attacks can succeed without installing malicious software.
- Exploitation of Legitimate Accounts: Compromised mailboxes can make fraudulent messages appear authentic.
- Operational Disruption: Fraud investigations and recovery efforts can interrupt routine business activities.
- Reputational Consequences: Clients and partners may lose confidence following successful impersonation or financial fraud.
- Compliance and Reporting Risks: Incidents involving personal information may trigger additional legal or regulatory responsibilities.
For example, a property management company may receive an email appearing to come from a regular contractor requesting that future payments be sent to a different bank account.
If an employee updates the supplier’s payment information without independent verification, the next legitimate invoice payment could be redirected to the attacker.
The email may contain no malicious attachment or suspicious link. The attack succeeds because the recipient trusts the apparent sender and follows the instructions.
BEC therefore demonstrates why cybersecurity cannot depend exclusively on technical threat detection. Business procedures and employee decision-making are equally important.
How Business Email Compromise Works
Business Email Compromise typically begins with an attacker gathering information about an organisation, its employees and commercial relationships.
Criminals may examine publicly available information, monitor compromised correspondence or use social engineering to identify individuals authorised to approve payments, manage suppliers or access confidential records.
The attacker then creates a convincing request designed to exploit an established workflow.
A Typical Business Email Compromise Attack Includes:
- Target Research: The attacker identifies relevant employees, senior executives, suppliers or financial processes.
- Identity Impersonation or Account Compromise: A fraudulent email address is created, or access is obtained to a legitimate mailbox.
- Message Preparation: The attacker constructs a request that resembles normal business communication.
- Social Engineering: The message uses urgency, authority, confidentiality or an existing relationship to encourage compliance.
- Fraudulent Instruction: The recipient is asked to transfer money, change payment details or disclose sensitive information.
- Unauthorised Action: An employee follows the request without completing the necessary verification procedures.
- Discovery and Response: The organisation identifies the fraud and attempts to contain the incident, recover funds or protect affected information.
BEC attacks can also develop over time. An attacker who has compromised a mailbox may read previous conversations to understand how a business communicates with suppliers or approves financial transactions.
They may then insert fraudulent instructions into an existing email thread, making the request appear more credible.
Another technique involves creating a visually similar email address or domain. Small differences in spelling may be overlooked, particularly when an employee is dealing with a high volume of messages.
However, not every BEC attack involves account compromise. Some rely entirely on impersonation, while others use legitimate compromised accounts to bypass the visual warning signs associated with suspicious domains.
This distinction is important because prevention requires both technical email protection and independent verification of sensitive instructions.
Common Types of Business Email Compromise
Business Email Compromise can take several forms depending on the attacker’s objective and the business processes being targeted.
Although the techniques differ, most attacks rely on impersonating a trusted party and persuading someone to take an action they would not otherwise authorise.
CEO Fraud and Executive Impersonation
Attackers pretend to be senior executives and instruct employees to make urgent payments or disclose confidential information.
These requests may claim that the matter is highly sensitive and should not be discussed with colleagues.
The objective is to exploit perceived authority and discourage normal verification procedures.
Supplier and Invoice Fraud
Criminals impersonate suppliers or compromise genuine supplier email accounts.
They may submit fraudulent invoices or request changes to existing bank account details.
This technique is particularly dangerous when the fraudulent message appears within an established supplier relationship.
Payroll Diversion Fraud
Attackers impersonate employees and request changes to salary payment information.
If payroll staff accept the instructions without verification, wages may be redirected to accounts controlled by criminals.
Account Compromise
An attacker gains unauthorised access to a legitimate business mailbox and uses it to send fraudulent messages.
Compromised accounts can be especially convincing because the sender address and previous conversation history may appear authentic.
Professional Services Impersonation
Criminals may impersonate solicitors, accountants, financial advisers or other trusted professionals.
Fraudulent messages can involve client payments, confidential documents, transaction instructions or changes to existing financial arrangements.
Data and Information Theft
Not all BEC attacks focus on immediate financial transfers.
Some request employee records, customer information, financial statements or other sensitive documents that may be used for further fraud.
Common BEC Attack Types Compared
| BEC Type | Typical Fraudulent Request | Primary Business Risk |
| Executive Impersonation | Urgent transfer requested by an apparent director | Unauthorised financial payment |
| Supplier Invoice Fraud | Invoice payment to altered bank details | Financial loss through payment diversion |
| Payroll Diversion | Change to an employee’s salary account | Misappropriation of wages |
| Account Compromise | Instructions sent from a legitimate compromised mailbox | Fraud, data exposure and further account misuse |
| Professional Services Impersonation | Payment or document request from an apparent adviser | Financial loss or disclosure of sensitive information |
| Data Theft | Request for confidential employee or customer records | Information compromise and potential regulatory consequences |
These attack types may overlap. For example, a criminal could compromise a supplier’s mailbox and then use an existing invoice conversation to request a fraudulent bank account change.
Understanding the different scenarios helps organisations identify which business processes require additional verification and oversight.
Common Business Email Compromise Risks and Warning Signs
BEC attacks often succeed because fraudulent instructions resemble legitimate business requests. Employees may be familiar with the apparent sender, recognise the subject matter or believe that a payment needs immediate attention.
Although individual warning signs do not always prove that a message is fraudulent, certain patterns should prompt additional verification.
Common BEC Warning Signs Include:
- Unexpected Bank Detail Changes: A supplier requests payment to a new account without a previously agreed verification process.
- Unusual Urgency: The sender insists that a payment or confidential request must be completed immediately.
- Requests for Secrecy: Employees are told not to discuss instructions with colleagues or normal approvers.
- Unfamiliar Email Domains: The sender’s address resembles a trusted organisation but contains subtle differences.
- Changes in Communication Style: A familiar contact suddenly uses unusual language or requests actions outside normal procedures.
- Bypassing Approval Processes: The message asks employees to ignore established financial or security controls.
- Unexpected Confidential Information Requests: Sensitive records are requested without a clear business justification.
- Resistance to Independent Verification: The sender discourages telephone confirmation or requests communication through unfamiliar channels.
- Suspicious Account Activity: Unusual sign-ins, unexpected forwarding rules or unfamiliar mailbox activity may indicate compromise.
- Requests Outside Normal Working Patterns: Financial instructions arrive at unusual times or from unexpected contacts.
For example, an accounts department may receive an invoice from a familiar supplier shortly before a payment deadline. The accompanying message explains that the supplier has changed banks and asks the employee to use the new account immediately.
The invoice may look genuine and refer to an existing purchase order.
However, without independent confirmation through previously established contact details, the organisation cannot safely assume that the bank account change is legitimate.
A further challenge is that traditional email filtering may not identify every BEC attempt. Messages sent from compromised legitimate accounts may satisfy standard email authentication checks.
Similarly, a fraudulent email may contain no malware, malicious links or attachments.
BEC prevention must therefore address the business process being targeted, not just the technical characteristics of an incoming message.
Best Practices for Preventing Business Email Compromise
Effective protection against BEC requires coordinated technical and organisational controls.
Email security technologies help reduce impersonation and account compromise, while business procedures prevent fraudulent instructions from being accepted without appropriate verification.
Organisations should focus particularly on activities involving payments, supplier records, payroll information and confidential data.
Best Practices for BEC Prevention Include:
- Implement Multi-Factor Authentication: Protect business email accounts, particularly those used by executives and finance teams.
- Strengthen Email Authentication: Configure SPF, DKIM and DMARC to help reduce unauthorised use of organisational email domains.
- Verify Changes to Bank Details: Confirm payment information through a trusted, independently established communication channel.
- Use Dual Approval for Sensitive Payments: Require appropriate secondary authorisation for significant or unusual transactions.
- Train Employees to Recognise Impersonation: Explain common BEC techniques and the importance of verifying unexpected instructions.
- Review Mailbox Security: Monitor suspicious sign-ins, unexpected forwarding rules and unusual account behaviour.
- Apply Appropriate Access Controls: Restrict administrative permissions and protect accounts containing sensitive information.
- Establish Clear Financial Procedures: Document how invoices, supplier amendments and payroll changes must be approved.
- Maintain Incident Response Arrangements: Define how suspected fraud should be reported, investigated and escalated.
- Review Supplier Communication Processes: Confirm reliable contact information and establish secure procedures for sensitive changes.
- Monitor Security Alerts: Investigate relevant authentication events and suspicious email activity.
- Test Employee Awareness: Use appropriate training exercises to reinforce secure handling of payment and information requests.
Email authentication measures deserve particular attention.
SPF, DKIM and DMARC help organisations establish whether messages are authorised to use their domains and can reduce certain forms of email spoofing.
However, these controls do not prevent every impersonation attempt or stop criminals from sending fraudulent messages through legitimate compromised accounts.
Financial verification procedures remain essential.
For example, if a supplier requests a change of bank details, the employee should contact the supplier using a telephone number or contact method already held in trusted business records.
Replying directly to the suspicious email is not sufficient because the attacker may control the account or conversation.
Organisations should also establish clear procedures for responding when BEC is suspected.
If a fraudulent payment has been made, promptly contacting the organisation’s bank and relevant financial institutions may improve the opportunity to investigate or attempt recovery. In the UK, suspected fraud should also be reported through the appropriate police reporting arrangements.
Where personal information has been compromised, the organisation should assess whether additional notification obligations apply under UK data protection law.
For London SMEs and regulated firms, documented approval procedures, employee training records and incident response arrangements can also support IT governance and compliance readiness.
BEC prevention is most effective when technical safeguards and financial controls are maintained together.
Conclusion: Why Business Email Compromise Matters
Business Email Compromise is a serious cybersecurity and financial threat because it exploits trusted communication and established business processes. Through executive impersonation, compromised mailboxes, fraudulent invoices and other social engineering techniques, attackers attempt to persuade employees to transfer funds or disclose information without proper authorisation.
For London SMEs and regulated firms, effective BEC protection requires more than filtering suspicious emails. Strong authentication, secure account management, employee awareness and independent verification of financial instructions all contribute to reducing the risk. Clear incident response procedures are also essential when suspicious activity or attempted fraud is identified.
A well-managed approach to BEC prevention connects cybersecurity with practical business controls. By protecting email accounts, strengthening payment approval procedures and encouraging employees to verify unusual requests, organisations can reduce the likelihood of successful impersonation and maintain greater confidence in their financial and information security processes.