Business email compromise explained: is your email security keeping up?

When people picture a cyber attack, they often imagine malware, ransomware or a dramatic breach. Business email compromise (BEC) is quieter. There may be no malicious attachment, no virus, nothing for traditional antivirus to catch. Just a convincing email asking someone to do something that seems completely normal.

It’s also one of the most costly types of cybercrime for businesses.

How business email compromise works

BEC attacks rely on impersonation and trust. Common variations include:

• CEO fraud. An email that appears to come from a senior leader asks for an urgent payment or a purchase of gift cards.
• Supplier invoice fraud. A real or lookalike supplier account asks for payment to new bank details.
• Account compromise. Attackers take over a genuine mailbox, then use it to send requests to colleagues, customers or suppliers, often replying within existing conversations.
• Payroll diversion. An employee appears to ask HR to change the bank account their salary is paid into.

Because the messages often come from real or near-identical addresses and contain no obvious malware, they can slip past basic filters.

Warning signs

• A change of bank details, especially with urgency attached.
• Requests to keep something confidential or to skip normal approval steps.
• Slight differences in an email address or domain, such as an extra letter or a different ending.
• A change in tone, timing or reply-to address in an otherwise normal conversation.

How to defend against it

Strong email security. Modern email protection goes beyond spam filtering. It analyses sender behaviour, detects impersonation and lookalike domains, and can remove malicious messages from inboxes after delivery when new threats are identified.

Email authentication. SPF, DKIM and DMARC help stop criminals sending emails that appear to come from your domain, protecting your customers and suppliers as well as your staff.

Multi-factor authentication. If a password is stolen, MFA makes it much harder for an attacker to take over the mailbox.

Payment verification processes. Require a call-back to a known number for any change to payment details or any unusual payment request. Make it a rule that applies to everyone, including senior leaders.

Mailbox monitoring. Watch for signs of compromise, such as suspicious logins or new forwarding rules that quietly send copies of emails elsewhere.

Training. Help staff recognise impersonation and feel confident challenging requests, even when they appear to come from the top.

Email is still the front door

Despite new collaboration tools, email remains central to how businesses communicate with customers and suppliers, and the most common starting point for attacks. Protecting it properly is one of the highest-value investments you can make.

What to do if you suspect a compromised mailbox

Speed matters. If you suspect an email account has been compromised, act straight away.

1. Reset the password and sign the user out of all active sessions.
2. Check multi-factor authentication settings for any methods the user didn’t add.
3. Review mailbox rules and forwarding for anything that hides, deletes or forwards messages.
4. Check sent items for emails the user didn’t send, especially payment requests.
5. Warn colleagues, customers and suppliers who may have received fraudulent messages.
6. Contact your bank immediately if any payments may have been diverted.
7. Review sign-in logs to understand when and where the attacker accessed the account.
8. Preserve evidence for investigation and any reporting obligations.

It’s also important to work out how the account was compromised in the first place, so the same route can’t be used again. Common causes include phishing, reused passwords and weak or missing multi-factor authentication.

Finally, consider whether the incident needs to be reported. If personal data was exposed, you may have obligations under UK GDPR. Your incident response partner can help you assess this quickly.