BEC causes more financial loss than any other cybercrime category, and it frequently passes authentication because the mailbox is real.
How to implement business email compromise (BEC)#
- Require MFA on all mailboxes and disable legacy authentication protocols.
- Alert on new inbox rules that forward or delete mail, a common attacker persistence step.
- Verify payment changes by phone using a known number, never the one in the email.
- Flag external mail with display names matching internal staff.
How to verify it worked#
Send a test message to seed mailboxes at Gmail, Outlook, and Yahoo, then inspect the Authentication-Results and delivery headers. Repeat after any DNS or sending-platform change.
Common mistakes#
- Assuming DMARC protects against BEC from a compromised real account.
- No out-of-band verification policy for finance.
Frequently asked questions#
How is BEC different from phishing?
Phishing casts wide for credentials; BEC is targeted social engineering for money, often using a real hijacked account.