The one-sentence version#
BEC is a targeted attack where an attacker impersonates an executive or vendor to redirect payments or extract data, often from a legitimate compromised mailbox rather than a spoofed one.
Why you should care#
BEC causes more financial loss than any other cybercrime category, and it frequently passes authentication because the mailbox is real.
The mental model#
Think of business email compromise (BEC) as a contract between you and the mailbox providers receiving your mail. You publish or configure something they can check; they check it on every message; the result feeds their decision about where your message lands. Everything below is about making that check pass consistently.
Your first setup, step by step#
- Require MFA on all mailboxes and disable legacy authentication protocols.
- Alert on new inbox rules that forward or delete mail, a common attacker persistence step.
- Verify payment changes by phone using a known number, never the one in the email.
- Flag external mail with display names matching internal staff.
Words you will see#
- Mailbox provider: Gmail, Microsoft, Yahoo, Apple, and the corporate gateways that decide where mail lands.
- Authentication: proof that a message is from who it says it is (SPF, DKIM, DMARC).
- Reputation: the provider's running score of your domain and IP.
- Placement: whether a message reaches the inbox, spam, or is rejected.
Common mistakes#
- Assuming DMARC protects against BEC from a compromised real account.
- No out-of-band verification policy for finance.
Frequently asked questions#
How is BEC different from phishing?
Phishing casts wide for credentials; BEC is targeted social engineering for money, often using a real hijacked account.