Business Email Compromise does not center on malware but on a credible email at the right moment. Attackers pose as management, a supplier, or a customer and get employees to transfer money to a third-party account or to disclose sensitive data. The variant with impersonated management is also known in German-speaking countries as CEO fraud or the "boss scam".
BEC is dangerous for companies because the messages often contain no suspicious links or attachments and therefore get past technical filters. The damage results from a seemingly ordinary business transaction.
How does Business Email Compromise work?
There are two basic variants:
- Spoofed sender: The email comes from a similar-looking domain, for example with two letters swapped, or merely uses a matching display name.
- Compromised account: Attackers have gained access to a real mailbox through phishing or stolen credentials. They sometimes read along for an extended period, create hidden forwarding or deletion rules, and then insert themselves into an ongoing email thread.
The message itself relies on familiar levers of social engineering: urgency, confidentiality, and authority.
Typical examples
- A supplier announces new bank details by email. The next invoice is paid into the fraudsters' account.
- The supposed managing director asks, from a meeting, for an urgent, confidential payment for an alleged project.
- Customers receive changed payment information from the compromised accounting mailbox.
- The HR department is asked to change an employee's salary account.
What companies should keep in mind
- Always confirm changes to bank details and unusual payments through a second, known channel, for example by calling back a number already on file.
- Introduce a four-eyes principle for payments above a defined threshold.
- Protect mailboxes with multi-factor authentication and restrict automatic forwarding to external addresses.
- Configure SPF, DKIM, and DMARC for your own domains so that your sender address is harder to spoof.
- Raise awareness specifically in accounting, purchasing, and HR, see security awareness.
How TOMORIS relates
TOMORIS UNIVERSITY offers employee awareness training in its Awareness area.
View awareness training