What CAN-SPAM requires#
CAN-SPAM requires accurate headers, a physical address, and honoring opt-outs within 10 business days.
What business email compromise (BEC) is#
BEC is a targeted attack where an attacker impersonates an executive or vendor to redirect payments or extract data, often from a legitimate compromised mailbox rather than a spoofed one.
Why it matters#
BEC causes more financial loss than any other cybercrime category, and it frequently passes authentication because the mailbox is real.
How business email compromise (BEC) supports CAN-SPAM compliance#
Regulators and recipients need to identify who sent a message and trust that opt-out mechanisms work. Business email compromise (BEC) contributes by bEC causes more financial loss than any other cybercrime category, and it frequently passes authentication because the mailbox is real.
Implementation steps#
- Require MFA on all mailboxes and disable legacy authentication protocols.
- Alert on new inbox rules that forward or delete mail, a common attacker persistence step.
- Verify payment changes by phone using a known number, never the one in the email.
- Flag external mail with display names matching internal staff.
Frequently asked questions#
How is BEC different from phishing?
Phishing casts wide for credentials; BEC is targeted social engineering for money, often using a real hijacked account.