Business email compromise (BEC) is a type of fraud in which criminals pose as a trusted person in email, such as an executive, a colleague or a supplier. The goal is to make an employee transfer money, change bank details or send sensitive information. MITRE ATT&CK lists BEC among the campaign types aimed at financial theft.

How it works

• The attacker takes over a real mailbox with stolen credentials, or uses a lookalike or spoofed domain.
• They study ongoing conversations, invoices and payment habits.
• A message arrives at the right moment, for example an urgent request from the “CEO” or a supplier’s “new” bank account.
• Mail rules may hide replies, so the real owner does not notice the fraud.

Why it matters for defenders

BEC often needs no malware, so technical filters may not stop it. The UK NCSC advises that important requests sent by email be verified through a second channel, such as a phone call. Strong MFA on mailboxes, email authentication and staff training also help. Two early signals can be watched from outside: mailbox credentials that appear in leaks, and lookalike domains registered for a company. Monitoring for lookalike and phishing domains gives time to act before a fake domain is used.

Sources: MITRE ATT&CK T1657: Financial Theft, NCSC: Phishing attacks: defending your organisation