Business Email Compromise Explained: How Fake Invoices and Spoofed Bosses Cost Companies Money

What business email compromise really is

Business email compromise is a form of fraud in which an attacker pretends to be someone the victim trusts, and uses that trust to move money or collect confidential information. The sender might claim to be the managing director, a long-standing supplier, your accountant or a customer.

What makes it dangerous is how ordinary it looks. There is often no virus, no strange link and no obvious spelling mistakes. There is just a plausible request that arrives at a busy moment.

The scripts criminals reuse

Most BEC cases follow a handful of patterns. Knowing them makes it easier to spot something that does not fit.

• The urgent boss: an executive asks a finance employee for a quick, confidential payment or gift cards
• The changed bank details: a supplier announces a new account number for future invoices
• The fake invoice: a realistic bill for something you might plausibly have bought
• The payroll diversion: an employee supposedly asks HR to update their bank account
• The data request: someone pretending to be a manager asks for staff tax or personal records

Two ways the fraud is delivered

In the first, the attacker creates a lookalike. This might be a domain with one letter changed, or a free email account using the boss's name in the display name. Mobile mail apps often show only the display name, which makes this trick work.

In the second, the attacker has actually broken into a real mailbox, perhaps yours or your supplier's. They read ongoing conversations, wait for a payment to be discussed and then insert themselves with a new set of bank details. Because the message comes from a genuine account in a genuine thread, it is much harder to question.

Warning signs worth training staff on

No single sign proves fraud, but a combination should slow things down.

• Pressure to act quickly or keep the request secret
• A change in payment method, account or contact details
• Requests that skip the normal approval process
• A reply-to address that differs from the sender address
• Slightly odd tone, timing or phrasing for that person

The process controls that work

Because the emails look legitimate, the most reliable defence is a rule that does not depend on spotting the fake. Any change to bank details, and any unusual payment, is verified by calling the person back on a phone number you already hold, not one in the email.

Add a second approver for payments above a threshold you choose, and keep a short list of known supplier contact numbers. Staff should be told clearly that they will never be criticised for double-checking a request, even when it appears to come from the owner.

Technical steps that support the process

Turn on multi-factor authentication for every mailbox, especially those of finance staff and executives. Review mailbox rules regularly, because attackers often create hidden forwarding rules after a break-in. Enable the anti-spoofing records for your domain, known as SPF, DKIM and DMARC, and ask your email provider or IT contact to help configure them correctly.

Also consider flagging external senders with a visible banner. It is a small change that reminds staff when a message that appears to come from the boss actually came from outside.

A realistic example, step by step

Imagine a small construction firm that regularly pays a materials supplier. An attacker breaks into the supplier's mailbox, perhaps through a reused password, and spends a few days reading invoices. When the next invoice goes out, the attacker sends a follow-up from the real address saying that the bank has changed and the new details are attached.

The accounts clerk notices nothing unusual. The email thread is genuine, the tone matches, and the amount is correct. The payment is made to a new account. Only when the real supplier chases for the overdue invoice does anyone realise what has happened, and by then the money has usually been moved on through several accounts.

Notice what would have stopped this: a phone call to the supplier on a number already in the contact book. It takes two minutes, and no software was required. That is why the process rule is the heart of any BEC defence, and why it must apply to everyone, including senior staff who might otherwise feel they are being slowed down.

Building a verification habit

Habits stick when they are easy and specific. Put the rule in writing and make it part of onboarding for anyone who touches money or personal data.

Call your bank straight away to try to recall the payment, then report the incident to the police or fraud service in your country. Secure the affected mailbox by changing the password, revoking active sessions and removing unknown rules. Tell the genuine supplier or customer so they can check their own systems. Keep copies of the emails, because they will be needed by your bank, insurer and investigators.

• Keep a verified contact list for suppliers, banks and key customers, updated through trusted channels
• Use call-back verification for any new bank details, however the request arrives
• Require a second person to approve first payments to a new payee
• Treat requests for gift cards, urgent transfers or secrecy as red flags by default
• Run a short simulated exercise twice a year so staff practise saying let me check