What is business email compromise (BEC)?
Business email compromise (BEC) is fraud in which an attacker impersonates, or takes over, a trusted email account, such as an executive, a colleague or a supplier, to redirect payments or obtain sensitive data. It often carries no link or attachment at all.
How it works
Typical schemes include fake invoices, changed bank details from a “supplier”, gift card requests from a “manager” and payroll diversion. Some use a lookalike domain; others use a real account the attacker has compromised.
Because the message is plain text with a believable request, email filters often let it through. Process controls, such as verifying payment changes by phone on a known number, stop most of it.
Why it matters
BEC targets the people who move money and data. Training and simulations for finance, procurement and HR, paired with verification steps, close the gap filters leave.
