Some of the most expensive cyber incidents involve no virus, no encryption and no dramatic breach — just a convincing email and a payment sent to the wrong account. Business email compromise is quiet, effective and aimed squarely at finance teams. Here is how it works and how to shut it down.
- BEC manipulates people into transferring money or changing payment details.
- It often relies on a compromised or spoofed email account rather than malware.
- Finance and accounts-payable staff are the primary targets.
- Process controls — verification, MFA and clean records — defend better than software alone.
What BEC actually is
Business email compromise (BEC) is a form of fraud where an attacker uses email to trick someone into transferring funds or revealing information. There is usually no malware — the weapon is a believable message, often from a compromised or spoofed account belonging to a supplier, executive or colleague.
The common playbooks
- Invoice redirection — a "supplier" emails new bank details for an upcoming payment.
- CEO fraud — an "executive" urgently requests a transfer, pressuring staff to bypass process.
- Payroll diversion — an "employee" asks to update their salary bank account.
- Account takeover — a genuinely compromised mailbox is used to hijack a real payment thread.
The amounts are often large and, once funds move, recovery is difficult.
Why finance teams are the target
BEC follows the money, so accounts-payable and finance staff are in the firing line. Attackers research their victims — supplier names, billing cycles, who approves what — frequently using information gleaned from a compromised mailbox or even from stolen accounting data. The more an attacker knows about your books, the more convincing the request.
How to defend against it
Technology helps, but process wins:
- Verify out of band — confirm any change to bank details by phone using a known number, never the one in the email.
- Enforce MFA on all email accounts to prevent takeover.
- Build in friction — require dual approval for payments and detail changes above a threshold.
- Train the team to treat urgency and secrecy as red flags.
- Keep clean records so you can quickly confirm the legitimate history of a supplier and payment.
The role of trustworthy records
Reliable, tamper-evident accounting records make verification faster and fraud easier to spot — and if an attacker alters data in your systems, an independent backup lets you compare against a known-good copy. Combine that with strong account hygiene and BEC has far fewer openings.