BEC is a targeted attack where an attacker impersonates an executive or vendor to redirect payments or extract data, often from a legitimate compromised mailbox rather than a spoofed one.
What good looks like#
- Done: Require MFA on all mailboxes and disable legacy authentication protocols.
- Done: Alert on new inbox rules that forward or delete mail, a common attacker persistence step.
- Done: Verify payment changes by phone using a known number, never the one in the email.
- Done: Flag external mail with display names matching internal staff.
What bad looks like#
- Seen in audits: Assuming DMARC protects against BEC from a compromised real account.
- Seen in audits: No out-of-band verification policy for finance.
How to move from bad to good#
Work through the good list in order and re-verify after each change. Most teams find one or two items from the bad list already present; fixing those usually produces the largest improvement.
Frequently asked questions#
How is BEC different from phishing?
Phishing casts wide for credentials; BEC is targeted social engineering for money, often using a real hijacked account.