How to Detect and Prevent Business Email Compromise
Business Email Compromise is the highest-dollar-loss cybercrime category tracked by the FBI, consistently outpacing ransomware in total financial impact. It is also the hardest category to defend against with traditional email security controls because the attack does not rely on malware, malicious links, or malicious attachments.
BEC attacks exploit trust: an attacker either compromises a legitimate email account and uses it to conduct fraud, or impersonates a trusted contact from a lookalike domain. The email passes gateway scanning because there is nothing technically malicious to detect. The loss happens when a human follows fraudulent instructions.
Effective BEC defense requires controls across three layers: preventing account takeover (so attackers cannot compromise legitimate accounts to use in BEC), detecting BEC-specific email patterns (so the attack surface that lacks malware can still be detected behaviorally), and implementing process controls that require out-of-band verification for high-risk financial transactions.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts — distilled for practitioners. 50,000+ subscribers. No noise.
Preventing Account Takeover: The Root Cause of Most BEC
The most impactful BEC attacks involve a compromised legitimate account. When an attacker controls the CFO's email account, there is no impersonation to detect — the emails come from the real account, are signed with the real signing key, and pass all authentication checks. Preventing account takeover is therefore the highest-priority BEC control.
Phishing-resistant MFA is the single most impactful account takeover prevention control. FIDO2/passkeys and hardware security keys are resistant to AiTM (adversary-in-the-middle) phishing kits that can steal session tokens from standard MFA methods. AiTM phishing is the dominant account takeover technique in current BEC campaigns — it presents a real-time proxy of the legitimate login page, capturing the authentication session after the victim completes MFA. FIDO2 keys are cryptographically bound to the origin domain, making them immune to AiTM because the key refuses to authenticate to a proxy domain.
Conditional access policies that detect impossible travel, unfamiliar device registration, and session anomalies catch AiTM-compromised sessions even when MFA was bypassed. Configure conditional access to require re-authentication from persistent high-risk signals and to block token replay from unexpected locations.
Audit email forwarding rules monthly. A common BEC technique is to create inbox rules on a compromised account that forward incoming emails matching specific keywords (invoice, payment, wire) to an attacker-controlled address. This allows the attacker to monitor financial email correspondence for weeks before initiating the fraud attempt. Alert on new forwarding rule creation in your email platform (Microsoft 365 Unified Audit Log, Google Workspace Admin SDK) and review all existing forwarding rules quarterly.
BEC Detection: Behavioral Analytics for Email Fraud Patterns
Because BEC emails typically contain no malware, link, or attachment to scan, detection must rely on behavioral analytics that identify anomalous email patterns.
Domain impersonation detection catches lookalike domains that attackers register to impersonate vendors, executives, or partners. Configure your email gateway to detect: lookalike domains using homoglyph characters (rn versus m, 0 versus O), typosquatting domains (company-name.net when the real domain is company-name.com), and cousin domains (companyname-invoices.com). Abnormal Security, Agari (Fortra), and Proofpoint all provide domain impersonation detection that generates alerts on emails from domains registered within the past 30 days that closely resemble your supplier domains.
Urgency and payment keyword detection flags emails with language patterns characteristic of BEC: requests for wire transfers or gift card purchases with urgency framing, requests to change payment account information, and requests to override normal approval processes. This detection produces significant false positives in organizations with legitimate urgent payment workflows — tune it with exceptions for known senders and domains before enabling alerting.
Abnormal communication detection identifies emails from known contacts that display atypical patterns: an email sent from a supplier's domain at an unusual time, from an unusual IP geolocation, or with unusual grammar patterns. Abnormal Security is the commercial leader in AI-based behavioral BEC detection — its models baseline communication patterns per sender and flag deviations that signature-based controls miss.
Process Controls: Out-of-Band Verification for High-Risk Transactions
Technical controls reduce BEC exposure but cannot eliminate it entirely. Process controls that require out-of-band verification for high-risk transactions are the backstop when email-based controls are insufficient or bypassed.
For wire transfer requests: require phone verification using a known, pre-registered number (not a number provided in the request email) for any wire transfer above a defined threshold. The verification call must occur before the transfer is initiated, not as a callback after. Document the call in the transaction record. This single control prevents the majority of successful BEC wire fraud attempts because attackers cannot control the voice call.
For payment information changes: require a formal change request form, multi-person approval, and verification call before updating any banking information for an existing vendor or employee. Payroll diversion BEC specifically targets HR and payroll teams with fraudulent requests to update direct deposit information — the request appears to come from the employee but originates from a compromised account or impersonation. Require that all direct deposit changes be submitted through a self-service portal with MFA authentication rather than via email request to HR.
For vendor email compromise: verify payment information changes from vendors through a previously established contact channel before processing. If a vendor emails to notify you that their banking details have changed, call the vendor using a phone number you independently verified (from their website, a previous invoice, your existing vendor file) rather than any number provided in the change notification email. Vendor email compromise (VEC) attacks target organizations' accounts payable processes specifically and frequently involve compromised vendor accounts rather than impersonation.
BEC Incident Response: What to Do When Fraud Occurs
BEC fraud moves faster than most financial institution fraud recovery processes. The first two hours after discovery are the only window in which fund recovery is possible.
If an employee suspects they have processed a fraudulent payment: immediately contact your bank and request a recall of the wire transfer. US-based organizations should also contact the FBI's Internet Crime Complaint Center (IC3.gov) and request activation of the Financial Fraud Kill Chain (FFKC) — a program that coordinates with receiving financial institutions to freeze funds in transit. The FFKC has a high success rate for recoveries initiated within 24 hours of the transfer.
Preserve all email evidence: full email headers, the complete email chain, and any email forwarding rules or inbox rules created during the incident period. Do not delete the compromised email account — preserve it for forensic analysis by your incident response team or external IR provider.
Reset all credentials for the compromised account and any accounts with shared credentials or access to the same systems. Review inbox rules, email forwarding, and OAuth application permissions for the compromised account — attackers frequently create persistence mechanisms that survive a password reset. Revoke and re-issue email signing keys and review mail flow rules for any backdoors the attacker may have inserted at the organizational level.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, remediation steps, and every daily briefing.
The bottom line
BEC is a hybrid attack: it succeeds through a combination of technical account compromise or impersonation and social engineering that exploits organizational payment workflows. Defending against it requires both technical controls (phishing-resistant MFA, behavioral email analytics, impersonation detection) and process controls (out-of-band verification for high-risk financial transactions). Either layer alone is insufficient. Organizations that have only one layer will continue to lose money to BEC until they have both.
Frequently asked questions
What is the difference between BEC and phishing?
Phishing is a broad attack category that uses deceptive emails to trick recipients into clicking malicious links, opening malicious attachments, or providing credentials. BEC is a specific fraud scheme that impersonates or compromises trusted parties to authorize fraudulent financial transactions. Most phishing attacks aim to compromise credentials for later use; BEC attacks use compromised or impersonated credentials directly for financial fraud. BEC emails typically contain no malicious technical content — they rely entirely on social engineering and the victim's willingness to follow what appears to be a legitimate internal instruction.
What is vendor email compromise (VEC)?
Vendor Email Compromise is a BEC variant in which attackers compromise a vendor's or supplier's actual email account rather than impersonating them from a lookalike domain. When an attack comes from the real vendor account with authentic email signatures, traditional impersonation detection fails. VEC attacks typically involve monitoring the victim's financial email correspondence for weeks before sending a fraudulent payment redirection request. Defense requires behavioral analytics that detect anomalous communication patterns from known vendors, and process controls that verify payment changes through independently verified contact channels.
Does DMARC prevent BEC?
DMARC prevents domain spoofing — emails that forge the exact From domain your organization or your vendors own. It does not prevent lookalike domain impersonation (a domain that closely resembles but is not identical to the legitimate domain), cousin domain attacks, or attacks from compromised legitimate accounts. DMARC is a necessary baseline control but should not be positioned as a BEC defense. Organizations with DMARC enforcement still experience significant BEC losses because the attacks that cause most losses do not involve domain spoofing.
What is the FBI Financial Fraud Kill Chain?
The Financial Fraud Kill Chain (FFKC) is a program administered by the FBI in coordination with the US Treasury Department and financial institutions that attempts to recover funds lost to wire fraud. Organizations that report BEC wire fraud to IC3.gov and request FFKC activation within 24 to 48 hours of the fraudulent transfer have a roughly 72% chance of full or partial fund recovery. Beyond 72 hours, recovery probability drops sharply as funds are moved through additional accounts or converted. Report BEC fraud to IC3.gov immediately — do not wait for internal investigation to complete before reporting.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, weekly, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals weekly.