Business Email Compromise: When an Ordinary Payment Request Is the Attack

Four versions of the same fraud

Nothing in a BEC attack breaks your software. It works on habit and on the trust people place in familiar names. These are the forms it usually takes.

• A supplier’s invoice with new bank details. The vendor is one you know. The name and logo are right, and only the account number has changed. In some cases the vendor’s own mailbox was taken over, which means the message really does come from an address you trust.
• A message from the top. Someone in finance hears from what looks like the owner or CEO: wire this today, or go buy gift cards. The message invokes rank, says there is no time, and asks for discretion, all so the employee acts before checking.
• A lawyer or closing agent. Shortly before a settlement or closing, when a large amount is due on a tight schedule, revised wire instructions arrive from an impostor or from a law firm whose account has been compromised.
• A hijacked employee mailbox. The attacker gains access to a genuine staff inbox and sends payment requests from it to coworkers, clients, and partners. Every detail checks out, since the account is real. Only the person typing is not who they claim to be.

Each version comes down to the same thing. A person is asked to move money or update payment details, and the request appears to come from someone they have reason to believe.

What AI took away

Staff used to be taught to watch for clues: clumsy grammar, odd phrasing, a greeting addressed to nobody in particular. Generative AI has removed those clues.

An attacker can now turn out a message with clean grammar and the right tone, tailored with details from your website, LinkedIn, old posts, and leaked data. It can mention an actual colleague, an actual project, or an actual deal, and it can sound just like the person being imitated. Badly written phishing is dying out.

Text is no longer the limit either. Deepfake audio and video can reproduce a voice or a face you know. Picture a finance manager who would have paused over a wire request by email. That pause may disappear once the “CEO” seems to confirm the request on a call. AI also allows these schemes to run in volume and to continue across channels. An email is followed by a LinkedIn message and then a phone call, and each makes the one before it more believable.

The conclusion is not a comfortable one. A message sounding authentic is no longer evidence that it is authentic, because producing authentic-sounding messages is precisely what these tools do well.

Defenses, starting with the phone

BEC goes after people and procedures, not software. So the defense has a technical part and a behavioral part, and the behavioral part matters more.

Start with verification. The most effective control is free. Before any payment goes out, and before any bank details are changed, call a number you already had on file. Do not use a number supplied in the email. Write the step into your procedure so that it happens as a matter of course and no one feels awkward doing it:

• Wires over a threshold you set need two approvers.
• A new payee or altered banking instructions needs spoken confirmation through a separate channel, whoever the request seems to be from.
• Urgency and secrecy count as warning signs. They are never a reason to skip a step, since the fraud relies on exactly that pressure.

Add technology to make the fraud harder. These controls raise the difficulty of a BEC attempt:

• MFA on all accounts, so that a stolen password is not enough to open a mailbox. The most persuasive BEC attacks start from a compromised account.
• SPF, DKIM, and DMARC, which make it hard for an attacker to forge your own domain when writing to your staff, vendors, and clients.
• Advanced email filtering that checks for impersonation and anomalies as well as spam and known-bad links.
• Least-privilege access, which keeps one compromised account from reaching everything.

Train the people in the path of the money. Attackers target whoever handles payments: bookkeeping, finance, executive assistants. Those staff should be familiar with current tactics, deepfakes among them. They should also understand that they are expected to question a strange request, including one that seems to come from the boss.

Professional firms and family offices face more of this than most. They move large amounts and operate on discretion and trust, and BEC is designed for those conditions. We cover that in more detail in our article on how family offices get attacked.

This is the routine work behind our managed cybersecurity service: email defenses, identity controls, and verification habits, so that a persuasive message does not turn into a six-figure loss.

Would your process catch one? Answer a few questions about email, payments, and access, and you will see where a BEC attempt could get through. About three minutes.

→ Check your exposure · Book a consultation