Preventing Business Email Compromise (BEC): A Guide for Teams
BEC scams cost businesses billions every year. Here is how to identify and prevent sophisticated 'CEO Fraud' and invoice hijacking attacks.
Business Email Compromise (BEC) is one of the most financially damaging forms of cybercrime. Unlike "bulk" phishing that targets everyone, BEC is a highly targeted attack where a scammer impersonates a high-level executive or a trusted supplier to trick an employee into making a large, unauthorized payment.
Because BEC often involves no malicious links or attachments—relying purely on social engineering and "spoofed" identities—it is incredibly difficult for traditional email filters to catch.
Here is how your team can spot and stop BEC attacks.
Common BEC Attack Scenarios
1. The "CEO Fraud" / Urgent Payment Request
An employee in the finance department receives an urgent email from "the CEO" (or another senior executive). The CEO says they are in a meeting or traveling and need a "confidential" payment made immediately to a new vendor.
The Red Flag: Sudden requests for secrecy, extreme urgency, and a departure from standard payment procedures.
2. The "Invoice Hijack"
A long-term supplier emails you to say their bank details have changed and all future payments should be sent to a new account. The email might even include a legitimate-looking PDF invoice.
The Red Flag: This happens when a scammer compromises the supplier's email account. The request is real, the person is real, but the bank details are the scammer's.
3. The "Payroll Update" Scam
An "employee" (actually a scammer) emails HR or payroll asking to update their direct deposit information for the next pay cycle.
The Red Flag: Requests to change sensitive banking info via a simple email without any additional verification.
How to Spot a BEC Attempt
- Check the "Reply-To" Mismatch: A scammer may spoof the "From" address (making it look official), but when you hit "Reply," the address changes to a different, unofficial one. Always check the reply address before sending sensitive info.
- Watch for Tone Shifts: If your CEO is usually formal but suddenly sends a casual, urgent email with typos, be suspicious.
- Look for "Lookalike" Domains: Scammers buy domains that are one letter off from your company's actual domain (e.g., `ceo@ultrondeveloprnent.com` instead of `ultrondevelopment.com`).
3 Rules for Business Teams
1. The "Secondary Verification" Rule
Never change bank details or make a large, unexpected payment based solely on an email. Always verify the request through a secondary, trusted channel:
- Call the person on their known extension or mobile number.
- Speak to them in person.
- Message them on a trusted internal platform like Slack or Teams.
2. Flag External Emails
Work with your IT department to add a visual banner to any email originating from outside your organization. This makes it much harder for a "spoofed" internal email to look legitimate.
3. Implement Multi-Person Approval
Require at least two different people to approve any change to supplier banking details or any payment above a certain threshold. BEC relies on tricking a single person into making a quick mistake.
Summary
BEC is a "human" attack, and it requires a "human" defense. By slowing down, verifying requests through a second channel, and implementing clear payment procedures, you can protect your company from even the most sophisticated email fraud.
Stop Guessing. Know if it's a scam instantly.
Join thousands of users who trust IsThisSpam to automatically analyze suspicious emails, links, and messages before they do any harm.
Stop Guessing. Know if it's a scam instantly.
Join thousands of users who trust IsThisSpam to automatically analyze suspicious emails, links, and messages before they do any harm.