Some of the most costly cyberattacks involve no malware at all. Business email compromise, or BEC, relies on one simple trick: convincing an employee that a fraudulent request comes from someone they trust. The result is usually money sent straight into a criminal’s account.
What is business email compromise?
BEC is a form of targeted fraud where attackers impersonate an executive, colleague, supplier or client by email. Their goal is to get the victim to transfer funds, change bank details, buy gift cards or share sensitive data such as payroll records.
Because BEC emails often contain only plain text, with no links or attachments, they can pass straight through basic spam filters.
Common BEC scenarios
CEO fraud. A finance employee receives an urgent message that appears to be from the managing director: “I’m in a meeting and need you to process a confidential payment today.”
Fake supplier invoices. A regular supplier “announces” new bank details. The next legitimate invoice gets paid into the attacker’s account.
Account takeover. Criminals log in to a real employee’s mailbox, often using a phished password, and send requests from inside the company. These are the hardest to spot because the address is genuine.
Payroll diversion. HR receives a request, apparently from an employee, to change the bank account their salary is paid into.
Lawyer or advisor impersonation. Attackers pose as legal or financial advisors handling a time-sensitive transaction.
Why BEC works
- It exploits trust and authority, not technology.
- Attackers research their targets carefully using public information.
- Requests are urgent and confidential, discouraging verification.
- Messages look routine, mimicking real workflows.
How to protect your business
1. Enforce two-factor authentication. Most account takeovers start with a stolen password. 2FA stops attackers from using it.
2. Restrict logins by country. If your team works in a handful of countries, block sign-ins from everywhere else. Many BEC gangs operate from regions where you have no staff.
3. Authenticate your domain. SPF, DKIM and DMARC prevent criminals from sending emails that appear to come from your exact domain.
4. Use AI-driven filtering. Machine learning can spot subtle signs of impersonation, such as unusual sender behaviour, look-alike domains and suspicious phrasing.
5. Set a verification rule. Any request to change bank details or make an unusual payment must be confirmed by phone, using a number already on file, never one provided in the email.
6. Train finance and HR teams. These departments are prime targets. Make sure they know the red flags and feel empowered to question requests, even from senior leaders.
If you’ve been targeted
Contact your bank immediately to try to stop or recall the transfer, secure the affected mailbox by resetting passwords and reviewing forwarding rules, and report the incident to the relevant authorities.
How Smardove helps stop BEC
Smardove combines the controls that matter most against BEC: two-factor authentication, country-based login restrictions, domain authentication support and an AI-driven antispam engine powered by SpamFoo that recognises impersonation patterns. Together they close the doors BEC attackers rely on.
| Protect your payments and your reputation. Contact Smardove to find out how secure hosted email can safeguard your business. |
