Business Email Compromise (BEC): What It Is and How to Prevent It?

Business Email Compromise (BEC) is one of the most dangerous and financially damaging cyber threats facing businesses today. It’s not just a scam—it’s a highly targeted attack that blends social engineering, impersonation, and business process manipulation to trick employees into transferring money or data.

The good news? Because BEC relies on human error, most attacks can be stopped with the right awareness, protection, and processes in place.

Let’s explore what BEC is, how it works, and how to protect your business.

What is Business Email Compromise (BEC)?

Business Email Compromise is a form of targeted cyberattack in which criminals impersonate trusted contacts—like a CEO, colleague, or supplier—to manipulate someone inside the business. The goal is usually financial fraud or data theft.

Unlike traditional phishing, BEC doesn’t rely on malware or dodgy links. Instead, attackers use:

Social engineering
Deceptive email techniques
AI-generated messages
Compromised accounts
And increasingly, deepfake technology

In a recent case,, a cybercriminal used a convincing deepfake video of a CFO to trick an Arup employee into transferring £20 million.

How Do BEC Attacks Work?

In a BEC scam, attackers pretend to be someone you trust — colleague, boss, or supplier — to trick you into transferring money or changing banking details.

These scams create a sense of urgency to push quick decisions. They don’t use malware or dodgy links, so many email security tools miss them. Instead, they rely on tricks like impersonation and even AI-generated content to make their messages look convincing.

To fool you, scammers use tricks like domain spoofing, lookalike domains, and typosquatting. Advanced moves, like using international characters or subdomains, make them even harder to spot — especially when working with external partners whose accounts might already be compromised.

Phase 1: Email List Targeting

Attackers start their campaigns by gathering email addresses. They collect contact details from sites like LinkedIn, business directories, and public websites. They also use data from old breaches and dark web databases (OSINT tools) to research their targets.

Phase 2: Launching the Attack

Attackers kick off BEC campaigns with mass emails, making them tricky to notice. They often use legitimate email accounts and rely on tactics like spoofing, lookalike domains, and fake sender names. Many scams begin with innocent-looking emails to gain trust before moving to more daring and dangerous requests.

Phase 3: Social Engineering

At this stage, attackers often step up their efforts and impersonate trusted people in the organisation, like senior executives or finance team members. These messages create urgency, pressuring the recipient to act quickly. To make their scams more convincing, attackers may use details from social media, referencing events or connections.

Phase 4: Financial Exploitation

Once they gain the target’s trust, attackers move to their goal—fraudulent wire transfers, vendore payment redirection, stealing credentials, or taking sensitive data. They often use multiple accounts and intermediaries to hide their tracks and launder stolen money.

Types of Business Email Compromise

CEO Fraud. CEO fraud is a type of BEC attack where hackers pretend to be a company executive and request urgent fund transfers, often skipping security checks when executives are unavailable.
Account Compromise. When it comes to account compromise, hackers gain access to an employee’s email account and request vendor payments, redirecting funds to fake accounts after studying internal processes.
False Invoice Scheme. BEC attackers pose as suppliers and ask for payments to fake accounts. Vendor email compromise (VEC) is now a common part of this scam.
Attorney Impersonation. Attorney impersonation is a type of attack in which scammers pretend to be lawyers or legal reps, targeting employees during big corporate events to make fake requests look real.
Data Theft. Attackers target HR staff to steal sensitive information about executives or employees, often using it later for BEC exploits like CEO fraud.

How Can BEC Affect a Small Businesses?

Business Email Compromise (BEC) is a growing problem for small businesses. It can harm your reputation, drain your finances, and even cause legal issues.

Reputational Damage

Reputation is closely linked to how much a business trusts new email contacts. Many companies are stepping up security with tools like two-step verification (2SV, 2FA or MFA) and encryption to protect their operations and reputation.

Disruption of Operations

BEC attacks disrupt operations, waste resources, and cause delays by diverting attention from critical tasks.

Financial Losses

For 21% of businesses hit by fraud attacks, the average loss per incident was £500,000. This shows the serious impact BEC can have, especially on small businesses with fewer resources. While 94% of companies have increased their tech budgets to fight these threats, only 33% use automated fraud prevention systems. This gap leaves many businesses open to expensive attacks, highlighting the need for better security measures.

Legal and Compliance Issues

Poor data protection can lead to legal trouble or fines for organisations. Laws like the UK GDPR and the Data Protection Act 2018 set strict rules, and breaking them can mean hefty penalties.

How to Prevent BEC Attacks

The National Cyber Security Centre (NCSC) has released new guidelines to help businesses protect against BEC attacks.

Minimise Your Digital Footprint

Cybercriminals often use publicly available information about senior staff to create believable phishing emails. To lower this risk, organisations should:

Limit how much personal and professional information is shared on company websites and social media.
Encourage senior executives to check and adjust their privacy settings on social media.
Pay attention to what is posted online, as it could be used for BEC attacks.

Train Employees to Identify Phishing Emails

Phishing emails can trick even careful employees. To help staff spot fake messages and enhance email protection:

Encourage a culture where employees feel comfortable questioning suspicious emails.
Tell staff to verify emails by contacting the sender using official contact details, not the ones in the email.
Remind employees to report suspicious emails to IT and mark them as spam.

Instead of relying only on phishing simulations, organisations should:

Train staff to recognise fake requests.
Make it easy and safe for employees to report phishing attack attempts.
Implement Two-Step Verification

Turning on two-step verification (2SV), also called two or multi-factor email authentication (2FA or MFA), adds extra security. It requires a second step, like a code sent via text or an authentication app. Setting up only takes a few minutes, so organisations should require MFA for all important accounts.

Restrict Access with ‘Least Privilege’

Not all employees should have access to financial information or the ability to make payments. To keep things secure:

Only give access to those who need it.
Review and remove permissions regularly.
Disable accounts when employees leave or change roles.
Double-check important email requests using another method, like a quick call.
Require multiple approvals for big transactions or new payment setups.

Plan for Potential Security Breaches

Even with preventive measures, you might be unable to stop BEC attacks, which can still happen. Here’s how to respond:

Create an incident response plan to manage compromised accounts, reset passwords and remove malware.
Run regular security drills to check your readiness.
Use tools like NCSC’s Exercise in a Box to test and improve defences.

Strengthen Your Email Security First

Last, but not least, make sure your systems are doing the heavy lifting as it makes sense to prevent the compromises rather than try spot them after they have got into staff mailboxes.

Most initial BEC attacks don’t contain malware or suspicious links, so traditional email filters often miss them. That’s why advanced email security tools are essential.

Look for a solution that:

Scans for impersonation attempts, even without malicious links
Blocks spoofed or lookalike domains
Uses AI and behavioural analysis to flag unusual messages
Offers domain protection with SPF, DKIM, and DMARC enforcement

In our opinion, it doesn’t seem fair to expect your internal staff to outsmart the cybercriminals who are using deepfakes and social engineering. Your tools should rather catch threats before they ever reach users inboxes.

What to Do If You Suspect a Compromised Email

Change your email password. Update it straight away to block unauthorised access.
Secure your account with two-step verification. Turn on 2SV to add an extra layer of security.
Check sent and deleted emails. Look for anything suspicious or unfamiliar.
Update your recovery information. Make sure your recovery details are correct and secure.
Run an antivirus scan. Use trusted software to check for malware or threats.
Report the breach. Let your email provider and relevant authorities know about the incident.

Get Your Free Email Security Health Check

Worried about BEC attacks?
Our free Email Security Health Check helps you spot where your business is exposed.

We’ll assess:

Whether your domain is protected from spoofing
How easy it would be for attackers to impersonate you
If your current email defences are effective

It’s quick, non-technical, and completely free.

Book your Email Security Health Check today and see how protected your communications really are.

FAQs

How do I report BEC attacks?

If you think you’ve made a fraudulent payment, contact your bank immediately using their official website or phone number. Report it to Action Fraud at 0300 1234 2040 or online at www.actionfraud.police.uk.

If you suspect you’re a victim of an email attack, look for signs like unknown emails, strange activity, or changes to security settings. Contact your IT team, or if you don’t have one, check out the NCSC’s guide on recovering hacked accounts for help.

How is a BEC attack different from a typical phishing email?

A Business Email Compromise attack is more targeted than a standard phishing email. While phishing emails are sent to lots of people with generic messages, BEC attacks focus on specific businesses or individuals.

How can I train my staff to recognise and prevent BEC attacks?

Regular security awareness training is an important step ind defending against BEC. Teach staff to double-check unusual requests for transferring money or sharing sensitive information—especially if they seem urgent or come from senior staff or trusted partners. Encourage them to confirm requests using another method, like a phone call, to make sure they’re legit.

Show employees tricks like fake email addresses or slight tweaks in email domain names. Set clear company rules for handling payments and sensitive data, and keep these up-to-date. Running phishing tests is also a good way to sharpen their ability to spot threats.

About
Latest Posts

Follow me

Francis West

CEO & Founder at Security Everywhere Ltd

I'm Francis West, CEO of Security Everywhere Ltd, where our mission is to protect 1,000,000 businesses from cybercrime. With over 30 years of experience in technology, my team and I help small and medium-sized businesses safeguard their finances, data, and reputation through practical, affordable cybersecurity solutions. Sheldon and I deliver workshops, keynote talks, and online sessions to empower business owners to understand and mitigate cyber risks effectively, making cybersecurity accessible and actionable so they can focus on growth and long-term success.