Imagine receiving an email from your company’s CFO.
The message references an ongoing transaction.
It uses familiar language.
The sender appears legitimate.
The request is urgent:
“Please update the payment instructions and process this transfer today.”
The recipient has worked with the CFO for years.
The transaction itself is legitimate.
The only thing that has changed is the bank account.
The payment is processed.
Days later, the organization discovers that the funds were sent to an attacker-controlled account.
This is a typical pattern in Business Email Compromise (BEC).
And it illustrates an important reality:
Some of the most financially damaging cyber incidents do not begin with malware. They begin with misplaced trust.
1. Why Business Email Compromise Remains Effective
BEC targets business processes that depend on trusted communications.
Attackers may attempt to impersonate:
- Executives
- Finance personnel
- Vendors
- Attorneys
- Business partners
- Payroll administrators
- Human resources employees
Common objectives include:
- Redirecting wire transfers
- Changing vendor banking details
- Diverting payroll deposits
- Obtaining tax documents
- Stealing sensitive business information
- Gaining access to enterprise systems
The FBI continues to identify BEC as a significant fraud threat.
Its 2024 advisory described approximately $55 billion in reported global exposed losses associated with BEC between October 2013 and December 2023. This figure represents reported actual and attempted exposure, rather than money necessarily lost. Internet Crime Complaint Center
The scale of the problem highlights why organizations need more than conventional spam filtering.
2. Attackers Exploit Relationships, Not Just Technology
BEC is particularly effective because the underlying request may appear entirely reasonable.
— A vendor regularly sends invoices.
— A CFO authorizes payments.
— An attorney requests documents.
— A payroll administrator processes changes.
Attackers exploit these established workflows.
A fraudulent email may reference an actual transaction, use familiar terminology, and arrive at a believable time.
The attack does not need to look suspicious in the traditional sense.
It needs to look like normal business.
3. BEC Does Not Always Require a Compromised Mailbox
There are several common attack paths.
Look-alike domains
An attacker registers a domain resembling a legitimate business.
For example:
company-payments.com
may be used to impersonate:
company.com
Display-name spoofing
The sender’s display name resembles a trusted executive, although the underlying email address differs.
Compromised email accounts
An attacker gains access to a legitimate mailbox and sends messages from it.
Conversation hijacking
The attacker observes an existing email conversation and introduces fraudulent payment instructions at the appropriate time.
Executive impersonation
The attacker pretends to be a senior leader and relies on authority or urgency to influence the recipient.
This variety of techniques is why checking the sender’s display name alone is insufficient.
4. A Legitimate Email Address Can Still Be Dangerous
Many people assume that if an email comes from a familiar address, it must be legitimate.
That is not always true.
If an attacker compromises a vendor’s email account, fraudulent payment instructions may originate from the real account.
The email may pass normal authentication checks because it was sent using legitimate infrastructure.
This creates a difficult situation.
The message may be technically authentic but the request itself is fraudulent.
That is why financial controls must remain independent of email authenticity.
A valid email address does not automatically validate a payment instruction.
5. Payment Verification Is One of the Most Important Controls
Organizations should establish a formal process for verifying changes to payment information.
Examples include:
- New vendor banking details
- Changes to existing payment instructions
- Unusual wire requests
- Requests to redirect payments
- Changes in payroll deposit information
Verification should occur through an independent channel using previously established contact information.
Do not rely solely on a phone number supplied in the suspicious email.
The FBI specifically recommends secondary-channel verification for payment changes and other sensitive account instructions. Internet Crime Complaint Center
A useful organizational policy is:
No change to established payment instructions should be accepted solely through email.
For higher-value transactions, organizations should consider requiring additional approval.
6. Strong Identity Security Reduces BEC Exposure
BEC frequently overlaps with identity compromise.
Once attackers gain access to an employee’s mailbox, they may be able to:
- Read financial conversations
- Identify vendors
- Search for invoices
- Learn internal approval processes
- Impersonate the employee
- Create forwarding rules
- Access shared documents
Strong identity security can reduce the likelihood of this happening.
Controls should include:
FIDO2/WebAuthn authentication can protect against many credential-relay phishing attacks.
Conditional access
Restrict risky authentication contexts.
Session monitoring
Detect abnormal session behavior.
Least privilege
Limit the information and systems available to compromised identities.
Access reviews
Ensure permissions remain appropriate.
CISA recommends phishing-resistant MFA wherever possible, particularly for sensitive business systems and privileged access. CISA
7. Protect Email Infrastructure
Technical email security remains essential.
Organizations should evaluate:
- SPF
- DKIM
- DMARC
- Anti-phishing controls
- Email impersonation protection
- Malicious attachment filtering
- URL analysis
- Suspicious forwarding rules
- Mailbox audit logging
SPF, DKIM, and DMARC can help reduce certain forms of domain spoofing.
However, they do not guarantee protection against look-alike domains or compromised legitimate accounts.
Email security should be layered with identity controls and financial verification.
8. AI Makes Impersonation Easier to Scale
Generative AI can help attackers produce convincing business communications.
Instead of poorly written phishing messages, attackers can generate:
- Grammatically accurate emails
- Professionally written payment requests
- Executive-style communications
- Messages adapted to particular industries
- Multilingual impersonation attempts
AI-generated voice impersonation introduces another concern.
An attacker may attempt to reinforce a fraudulent email with a phone call that sounds like a familiar executive.
Organizations should therefore avoid treating voice familiarity as sufficient proof of identity.
For sensitive financial transactions, verification should be based on established procedures rather than appearance, urgency, or familiarity.
9. Human Risk Intelligence Can Help Identify Exposure
BEC prevention benefits from understanding which business roles are most exposed.
For example:
Finance personnel may be targeted through payment redirection.
Executives may be impersonated.
HR employees may receive fraudulent payroll changes.
Legal personnel may receive sensitive document requests.
Procurement teams may handle vendor-account changes.
Risk-based training can focus on the specific fraud scenarios associated with each role.
But training should complement—not replace—technical and process controls.
10. Security Operations Should Monitor Identity and Email Activity
A mature SOC can help identify suspicious patterns such as:
- Unusual mailbox access
- Unexpected forwarding rules
- Suspicious OAuth application grants
- Changes to authentication methods
- New devices accessing sensitive accounts
- Abnormal login locations
- Suspicious email activity
These signals become more useful when correlated with identity information and threat intelligence.
For example:
An executive account logs in from an unfamiliar environment.
Shortly afterward, a new forwarding rule appears.
Then the account sends unusual financial messages.
Those events may indicate compromise even if no malware is detected.
11. What Should Organizations Do During a BEC (Business Email Compromise) Incident?
Speed matters.
If a fraudulent payment has occurred, the organization should immediately contact the originating financial institution and request assistance with stopping or recalling the transaction.
The incident should also be reported promptly to the FBI’s Internet Crime Complaint Center.
The FBI emphasizes that rapid reporting may improve the possibility of recovering funds, although recovery is not guaranteed. Internet Crime Complaint Center
At the same time, the security team should investigate:
- Whether accounts were compromised
- How the attacker gained access
- Whether sessions remain active
- Whether forwarding rules or malicious grants exist
- Whether additional employees were targeted
- Whether sensitive information was accessed
Relevant evidence should be preserved.
12. Build a BEC (Business Email Compromise) Prevention Program Around Four Principles
A practical prevention strategy can be organized around:
VERIFY
Independently validate sensitive financial requests.
PROTECT
Use strong identity and email security controls.
MONITOR
Detect abnormal authentication and mailbox activity.
RESPOND
Prepare financial and technical response procedures.
These principles address both the business process and the supporting technology.
Business Email Compromise Is an Enterprise Risk
BEC should not be viewed solely as an email-security problem.
It intersects with:
Financial controls
Human behavior
Digital risk protection
Threat intelligence
Security operations
The most effective programs coordinate these disciplines.
An organization may have excellent email filtering but weak payment verification.
Another may have strong financial controls but poorly protected executive accounts.
Reducing exposure requires both.
How Velocis Helps Reduce BEC Risk
Velocis Technologies helps organizations strengthen the controls surrounding business email and identity-related threats.
Relevant services include:
- Human Risk Intelligence
- Identity and Access Management
- Phishing-resistant MFA
- Threat Intelligence
- Digital Risk Protection
- Managed Security Operations
- Digital Forensics and Incident Response
Our approach connects preventive controls with monitoring and incident-response capabilities.
CTA — Assess Your Business Email Compromise Exposure
Would your organization detect an attacker using a legitimate employee mailbox to redirect a payment?
Request a Velocis Business Email Compromise Risk Assessment.
Contact: info@velocistech.com
Phone: 903-436-4044