Business email compromise: how it works and how to stop it

Business email compromise (BEC) is an email that impersonates someone the recipient trusts - an executive, a coworker, a supplier - to get them to send money or change payment details. The FBI's Internet Crime Complaint Center recorded 21,489 BEC complaints and $2.9 billion in adjusted losses in 2023, more than any other type of cybercrime it tracks except investment fraud.

This post is the practical side: what to look for and what to put in place. For why losses stay so high year after year, see why business email compromise stays so expensive.

A composite of the most common pattern. Names and domains are fictional.

1. 1The display name matches the real owner. The domain is northpine-supplies.com; the real one is northpinesupplies.com. Display names are free text - only the domain is hard to fake.
2. 2Urgency plus "can't take calls" removes the one check that would end this: a phone call.
3. 3A bank change on an existing supplier, introduced by email only. This is the highest-loss pattern.
4. 4No link, no attachment. There is nothing for a malware scanner or link checker to look at.

Built-in filtering in Gmail and Microsoft 365 is strongest against things seen before and sent in volume: known malware, spam campaigns, senders already flagged elsewhere. The example above has none of that - a domain registered days ago with no history, one recipient, and plain text.

What does work is checking what a careful person would check: does this domain merely resemble one you know, has this sender ever written to you before, and does the message follow a payment-change script. Zoes runs those checks on every message and labels this one Business email compromise, with the reasons shown next to it.

Filtering reduces how many of these reach people. Process is what stops the payment.

Payment controls

• Verify any new or changed bank details by phone, using a number you already have on file - never one from the email.
• Require a second person to approve payments above a set amount, and any first payment to new details.
• Treat "urgent" and "can't talk" as a reason to slow down, written into the finance checklist.

Account controls

• Turn on multi-factor authentication for every mailbox. Most account-compromise BEC starts with a stolen password.
• Block automatic forwarding to external addresses. Attackers who get into a mailbox set up forwarding rules to watch invoices.
• Publish SPF, DKIM and a DMARC policy for your own domain so attackers cannot send mail as you exactly.

Who to brief

Whoever can move money without a second signature: accounts payable, payroll, executive assistants, and at small companies the owner. In Zoes, Most Targeted Members shows which of these people receive the most dangerous mail.

Speed matters more than anything else here.

1. 1Call your bank immediately and ask them to recall the transfer and contact the receiving bank.
2. 2File a complaint at ic3.gov (US). The FBI's Recovery Asset Team works with banks to freeze funds, and reports filed quickly have the best chance.
3. 3Reset the password and sign out all sessions on any mailbox that may be compromised, and check it for forwarding rules.
4. 4Tell the real supplier or executive, so they can warn others being targeted from the same lookalike domain.