Skip to content
English - United States
Schedule Consultation
  • There are no suggestions because the search field is empty.

What Is Business Email Compromise (BEC)?

No malware, just a convincing email that redirects a payment. How BEC works and how to stop it.

Business email compromise (BEC) is a scam in which a criminal impersonates an executive, employee or vendor by email to redirect a payment or extract sensitive data. There is usually no malware and no link, which is why it slips past filters and why it is among the most financially damaging forms of cybercrime.

How a BEC attack unfolds

  1. The attacker either compromises a real mailbox (often through phishing and a missing MFA prompt) or registers a lookalike domain.
  2. They study the conversation: who approves payments, which vendors invoice you, how people write.
  3. At the right moment they send a request that fits the pattern: a vendor's "new bank account," an executive's urgent wire, a payroll direct-deposit change, or a request for W-2 data.
  4. Someone acts on it because it looks normal.

The common variants

  • Vendor invoice fraud. A real invoice with altered payment details.
  • Executive impersonation. "I'm in a meeting, need this wire sent today."
  • Payroll diversion. An "employee" asks HR to update their direct deposit.
  • Attorney or M&A pretext. Confidential deal, secrecy required, wire now.

How to stop it

  • Verify by voice. Any change to payment details or any unusual payment request is confirmed by calling a known number, never a number in the email.
  • Dual approval for wires and vendor bank changes.
  • MFA on every mailbox so a stolen password does not become a compromised inbox. See what is MFA.
  • Email authentication. SPF, DKIM and DMARC make it harder to spoof your domain. See SPF, DKIM and DMARC explained.
  • Mailbox rule monitoring. Attackers create forwarding rules to hide replies; a security team watches for them.
  • Training that includes BEC scenarios, not just link-clicking. See how employees spot phishing.

Mentis Group's Enhanced Cybersecurity services include email security, MFA enforcement and Cloud MDR for Microsoft 365, which watches for the mailbox behavior BEC depends on.

Have a question about your own environment? Schedule a consultation with Mentis Group or call (866) 901-7808.