Skip to content
Open Engine

Home Topics Email Security Management Business email compromise

Email Security Management · Business email compromise

What is business email compromise (BEC)? Definition, how it works, and why it matters

MailMaid Academy · · 1 min read DMARC pass
Short answer

BEC is a targeted attack where an attacker impersonates an executive or vendor to redirect payments or extract data, often from a legitimate compromised mailbox rather than a spoofed one.

What business email compromise (BEC) is#

BEC is a targeted attack where an attacker impersonates an executive or vendor to redirect payments or extract data, often from a legitimate compromised mailbox rather than a spoofed one.

Why it matters#

BEC causes more financial loss than any other cybercrime category, and it frequently passes authentication because the mailbox is real.

Getting started#

  1. Require MFA on all mailboxes and disable legacy authentication protocols.
  2. Alert on new inbox rules that forward or delete mail, a common attacker persistence step.
  3. Verify payment changes by phone using a known number, never the one in the email.
  4. Flag external mail with display names matching internal staff.

Common mistakes#

  • Assuming DMARC protects against BEC from a compromised real account.
  • No out-of-band verification policy for finance.

Frequently asked questions#

How is BEC different from phishing?

Phishing casts wide for credentials; BEC is targeted social engineering for money, often using a real hijacked account.

Keep reading on Business email compromise