Key takeaway
A central operational safeguard is to verify payment and account changes through a known channel outside email.
How BEC attacks exploit trust
Business email compromise (BEC) usually relies on social engineering rather than malware. An attacker may impersonate an executive and ask finance or HR to urgently transfer funds, disclose information or change account details. When a supplier’s mailbox is compromised, the conversation itself can look genuine. Treat urgency, secrecy or a request to bypass normal approval as risk signals.
Common scenarios
In executive impersonation, a message urgently requests a transfer or sensitive information. Invoice fraud spoofs or compromises a supplier’s address and sends a document with changed bank details. Payroll diversion uses a message posing as an employee to change direct-deposit information. A compromised vendor mailbox can insert new payment instructions into an existing conversation.
Verify payment and account changes separately
Require two-person approval for supplier bank changes, payroll-account changes and large transfers. Confirm the request using a phone number already on file or another known channel, not contact details in the email. Record who verified the change and when. Apply the rule even when the sender address and writing style look familiar.
Pair technical controls with staff training
Enable multifactor authentication for business email. Secure email gateways and anti-phishing filters help identify suspicious addresses, behavior and messages; SPF, DKIM and DMARC add controls against spoofing your domain. Train staff to report unexpected account changes, verify unusual requests through another channel and follow the organization’s incident-reporting process. Simulations let teams practise these decisions.