Business Email Compromise (BEC) is one of the most financially devastating cyber threats facing organisations today. Unlike generic phishing campaigns, BEC is a sophisticated, targeted deception that has cost UK businesses millions of pounds in recent years.
In this comprehensive guide, we’ll explain exactly what BEC is, how to identify the warning signs, and the steps you can take to protect your organisation from these increasingly common attacks. You’ll learn about the latest tactics cybercriminals use, who’s most at risk, and precisely what to do if you suspect your business has been compromised.
Whether you’re an IT professional, business owner, or concerned employee, this guide will equip you with the knowledge and practical strategies to defend against this serious threat.
Table of Contents
What Is Business Email Compromise (BEC)?
You may have heard of the term ‘Business Email Compromise’ or BEC. But what exactly is it?
Business Email Compromise (BEC) is a sophisticated email scam targeting businesses and organisations. Unlike general phishing attacks, BEC scams involve cybercriminals meticulously researching their targets before launching highly personalised attacks.
Also known as Email Account Compromise (EAC), CEO Fraud, or Whaling, BEC attacks typically involve criminals sending emails that appear to come from executives or trusted business partners. These emails often request wire transfers, sensitive information, or changes to payment details.
What makes BEC particularly dangerous is its targeted nature. Attackers research their victims extensively, learning about organisational structures, vendor relationships, payment systems, and even communication styles of executives they plan to impersonate.
Once they access the company’s emails, they use them to impersonate employees and send convincing messages to unsuspecting staff. These messages appear legitimate communications from a boss, colleague, client, or vendor, asking for sensitive data like credit card numbers, bank account details, login credentials, or national insurance numbers.
9 Warning Signs of Business Email Compromise Scams
Being able to identify a potential BEC attack before it succeeds is crucial. Here are nine warning signs that an email might be part of a business email compromise attempt:
- Unexpected urgency or pressure to act quickly: Messages emphasising that a payment must be made “today” or “within the hour” should raise immediate suspicion.
- Requests to change payment information or banking details: Be especially cautious of emails requesting changes to supplier payment details or bank account information.
- Emails from executives that seem “off” in tone or writing style: If a message from your CEO or finance director doesn’t sound like their usual communication style, it may be an impersonation.
- Requests to keep communication confidential: Phrases like “Please handle this personally” or “Don’t discuss this with the team” are common in BEC attempts to prevent verification.
- Minor differences in email domains: For example, emails from “company-name.com” versus the legitimate “companyname.com” or subtle misspellings like “connpany.com”.
- Grammar or spelling errors that seem unusual for the supposed sender: Senior executives typically send properly written communications; unusual errors can indicate fraud.
- Requests that bypass normal procedures or company policies: Any email asking you to ignore established verification processes deserves extra scrutiny.
- Email-only communication for financial matters: Beware of messages that insist on email-only communication, especially for financial transactions that would normally require additional verification.
- Sender’s email address doesn’t match past communications: Check previous emails from the same person to confirm the address is identical, not just similar.
If you notice any of these warning signs, stop and verify the request through a different communication channel before taking any action.
How Does Business Email Compromise Work?
Business email compromise attacks typically follow a sophisticated five-step process:
Research and Target Selection
Cybercriminals research potential victims using public information from company websites, social media profiles (especially LinkedIn), press releases, and data from previous breaches. They identify key executives, understand reporting structures, and learn about vendor relationships.
Initial Access
Attackers gain access to email systems through various methods:
- Phishing emails that harvest credentials.
- Malware that steals login information.
- Purchasing stolen credentials from the dark web.
- Exploiting unpatched vulnerabilities in email systems.
Reconnaissance and Monitoring
Once inside, criminals often spend weeks monitoring email communications to understand internal processes, payment procedures, and communication styles. They might study how invoices are formatted, which employees handle financial transactions, and the writing style of executives they plan to impersonate.
Email Manipulation
With this intelligence, the criminal either:
- Uses the compromised email account directly to send fraudulent requests.
- Creates a spoofed email address that looks nearly identical to a legitimate one.
- Modifies email reply chains to insert fraudulent payment instructions.
Execution
The attacker sends a carefully crafted email requesting a wire transfer, invoice payment to a new account, or sensitive information. These requests often include urgent language, confidentiality requirements, and just enough contextual information to seem legitimate.
The goal is to trick the recipient into transferring money to accounts controlled by the criminals or sharing sensitive information that can be used for further attacks or sold on the dark web.
Common Business Email Compromise Tactics and Techniques
Business email compromise attacks employ several sophisticated tactics:
CEO Fraud
Criminals impersonate the CEO or other high-level executives, sending urgent requests for wire transfers or sensitive information to employees who would normally follow such directives without question.
Invoice Fraud
Attackers pose as vendors or suppliers and send fake invoices or change payment instructions for legitimate ones, directing funds to fraudulent accounts.
Account Compromise
Criminals gain access to legitimate email accounts (often through phishing) and use them to request payments or send fake invoices to clients and partners.
Solicitor Impersonation
Scammers pose as solicitors or legal representatives, claiming to be handling confidential or time-sensitive matters requiring immediate payment.
Data Theft
Some BEC attacks focus on obtaining sensitive information like employee tax records or intellectual property rather than immediate financial gain.
One of the most common tactics in BEC attacks is changing specific details in legitimate communications. Criminals typically modify:
- Bank account numbers.
- Sort codes.
- Recipient names.
- Payment deadlines.
- Invoice numbers.
These subtle changes are often overlooked in otherwise legitimate-looking documents.
Business Email Compromise Statistics in 2025
The scale and impact of business email compromise attacks continue to grow at an alarming rate:
- BEC scams have caused over £1.8 billion in losses to UK businesses in the past year alone.
- The average loss from a successful BEC attack is approximately £35,000.
- 76% of businesses report having been targeted by at least one BEC attempt.
- Financial departments are targeted in 83% of attacks.
- 91% of successful BEC attacks begin with a spear-phishing email.
- It takes an average of 33 days for businesses to discover they’ve been victims of BEC.
- Only 14% of funds lost to BEC scams are ever recovered.
- BEC attacks have increased by 57% since 2023.
- Small and medium businesses are now targeted at nearly the same rate as large enterprises.
These statistics highlight the importance of implementing robust prevention measures and training employees to recognise the warning signs of BEC attacks.
Who Is at Risk for BEC Attacks?
While any organisation that uses email for business communications is potentially vulnerable to BEC attacks, certain factors significantly increase risk:
High-Risk Roles:
- Finance department staff who process payments.
- Human resources personnel with access to employee data.
- Executive assistants who may act on behalf of senior leadership.
- Procurement staff who manage vendor relationships.
- IT administrators with elevated system access.
Vulnerable Industries:
- Financial services firms handling large transaction volumes.
- Legal firms managing client funds and sensitive information.
- Manufacturing companies with complex international supply chains.
- Healthcare organisations with large vendor networks.
- Real estate businesses processing significant property transactions.
- Educational institutions with decentralised purchasing systems.
Small and medium-sized businesses face particular risk as they often lack dedicated security teams and sophisticated email protection systems while still processing valuable transactions.
Organisations undergoing significant changes such as mergers, acquisitions, or leadership transitions are also at elevated risk, as these events can create confusion that attackers exploit.
Understanding your organisation’s specific risk factors is the first step toward implementing appropriate protections.
What Are the Consequences of BEC?
The impact of successful business email compromise attacks extends far beyond the immediate financial loss:
Financial Damage
- Direct monetary losses, averaging £35,000 per incident.
- Secondary costs from investigation and remediation.
- Legal fees associated with recovery attempts.
- Increased cybersecurity insurance premiums.
- Potential regulatory fines if personal data was compromised.
Operational Disruption
- Business operations halted during investigation.
- IT systems taken offline for security assessment.
- Staff time diverted to incident response.
- Delayed payments to legitimate vendors.
Reputational Impact
- Loss of customer and partner trust.
- Negative media coverage.
- Strained relationships with vendors whose payments were diverted.
- Perception of poor security practices.
Legal and Regulatory Consequences
- Potential shareholder lawsuits for public companies.
- Regulatory investigations if the breach involved customer data.
- Requirements to disclose the incident in financial reporting.
- Possible violation of contractual obligations with clients or partners.
The cascading effects of a successful BEC attack can impact an organisation for months or even years after the initial incident, making prevention and early detection crucial.
How to Prevent Business Email Compromise
Protecting your business from BEC attacks requires a multi-layered approach combining technical controls, strong policies, and staff awareness:
Technical Safeguards
Strong technical controls, such as verifying sender authenticity and blocking suspicious emails, form your first line of defence against BEC attacks.
- Implement email authentication protocols (SPF, DKIM, and DMARC) to prevent email spoofing.
- Enable multi-factor authentication (MFA) for all email accounts, especially for executives and finance team members.
- Utilise advanced email filtering solutions that can detect anomalies in sender behaviour and email content.
- Keep all systems and software updated with the latest security patches.
- Consider using dedicated secure platforms for initiating and approving financial transactions.
Policy and Process Controls
Well-designed procedures create systematic safeguards that prevent hasty actions and ensure proper verification of all financial requests.
- Establish a verification process for payment changes and wire transfer requests that requires phone verification using previously known numbers (not numbers provided in the suspicious email).
- Implement approval workflows requiring multiple authorisations for transactions above certain thresholds.
- Create clear procedures for checking and confirming vendor payment information changes.
- Develop and enforce a policy against sharing sensitive information via email.
Employee Training and Awareness
Your staff represent both a potential vulnerability and your strongest defence when properly trained to recognise and respond to BEC attempts.
- Conduct regular security awareness training focusing specifically on BEC tactics.
- Run simulated phishing exercises that include BEC scenarios.
- Encourage a culture where questioning unusual requests is viewed positively.
- Train employees to verify requests through alternative channels before taking action.
Monitoring and Detection
Proactive monitoring helps identify suspicious activities before they result in financial loss by spotting unusual patterns or behaviours.
- Implement anomaly detection systems that can flag unusual email patterns or unexpected financial requests.
- Establish monitoring for email rule changes that might forward copies of emails to external addresses.
- Regularly review email forwarding rules and delegate access settings.
Implementing these preventative measures can significantly reduce your organisation’s risk of falling victim to a BEC attack.
Steps to Avoid Becoming a Victim of BEC Scams
To protect yourself and your organisation from becoming victims of business email compromise scams, follow these essential steps:
- Verify All Payment Change Requests: Never process changes to payment details without verifying through a different communication channel. Call the requester on a known phone number (not one provided in the email) to confirm.
- Establish Clear Payment Verification Procedures: Create and enforce formal procedures for verifying and approving financial transactions, especially those involving new payment recipients or changed bank details.
- Implement a Waiting Period for New or Changed Payment Instructions: Institute a mandatory 24-48 hour waiting period before processing new payment instructions or changes to existing ones.
- Use Multi-Person Approval for Significant Transactions: Require at least two people to approve wire transfers or payments above a certain threshold.
- Educate All Staff About BEC Threats: Conduct regular training sessions on recognising BEC attempts, focusing on real-world examples and current tactics.
- Question Urgent Payment Requests: Be especially suspicious of urgent payment requests, particularly when combined with claims that the CEO or another executive is unavailable for confirmation.
- Check Email Details Carefully: Train staff to examine sender email addresses thoroughly, not just the display name, looking for slight misspellings or domain variations.
- Create an Environment Where Verification is Encouraged: Foster a culture where employees feel comfortable questioning and verifying unusual requests without fear of reprimand.
Following these steps will significantly reduce your risk of falling victim to even the most sophisticated BEC attacks.
Business Email Compromise Protection Software
Several types of security solutions can help organisations detect and prevent business email compromise attacks:
Email Security Gateways
These solutions filter incoming emails for suspicious content, unusual sender patterns, and known malicious signatures. Leading providers offer AI-powered detection specifically trained to identify BEC attempts by analysing writing styles, request patterns, and email metadata.
Email Authentication Tools
These solutions help implement and manage SPF, DKIM, and DMARC protocols that verify sender authenticity and prevent spoofing. They provide reporting on email sources and can block unauthenticated messages.
Security Awareness Training Platforms
These platforms provide simulated phishing and BEC scenarios to test and train employees, along with educational modules specific to email security threats.
Anomaly Detection Systems
These solutions establish baselines of normal email and financial activity, then flag deviations that might indicate a BEC attack in progress.
Payment Verification Systems
Dedicated platforms for financial transactions that include built-in verification steps, approval workflows, and segregation of duties to prevent fraudulent payments.
When evaluating BEC protection software, look for solutions that offer:
- Machine learning capabilities that improve over time.
- Integration with your existing email and security infrastructure.
- Real-time protection and alerting.
- Comprehensive reporting and insight into attempted attacks.
- Regular updates to address emerging BEC tactics.
Remember that no single technical solution provides complete protection against BEC. The most effective approach combines appropriate software tools with strong policies and well-trained staff.
What to Do if You Are a Victim of BEC
If you discover your organisation has fallen victim to a business email compromise attack, immediate action is crucial. Follow these steps:
- Immediate Financial Response (First 24 Hours)
- Contact your bank immediately to recall the transfer (timing is critical).
- File a report with your financial institution’s fraud department.
- Document all details of the fraudulent transaction.
- Freeze relevant accounts if necessary to prevent additional losses.
- Technical Containment
- Isolate affected email accounts and change all passwords.
- Enable multi-factor authentication if not already active.
- Preserve all evidence including the fraudulent emails (do not delete them).
- Engage IT security staff or external experts to assess the extent of compromise.
- Report the Crime
- File a report with Action Fraud (the UK’s national fraud reporting centre).
- Contact the National Cyber Security Centre (NCSC) for guidance.
- If personal data was compromised, determine if the Information Commissioner’s Office (ICO) should be notified.
- Document all communication with law enforcement and regulatory bodies.
- Internal Communication and Investigation
- Notify senior leadership and legal counsel.
- Interview staff involved in the incident to understand what happened.
- Identify how the attack succeeded and what controls failed.
- Document the timeline of events for investigation purposes.
- Recovery and Remediation
- Implement immediate security improvements to prevent similar attacks.
- Conduct additional staff training focused on the specific type of BEC experienced.
- Review and strengthen verification procedures.
- Consider engaging external security experts for a comprehensive review.
- Long-term Follow-up
- Monitor for any additional suspicious activity.
- Enhance security awareness training for all staff.
- Implement any recommended security improvements.
- Review and update incident response procedures based on lessons learned.
Remember that rapid response significantly increases the chances of recovering funds and limiting damage. Many organisations have successfully recovered funds through prompt action with their financial institutions.
BEC Attack Examples and Case Studies
Understanding how BEC attacks unfold in the real world can help organisations better prepare. Here are some anonymised examples:
Case Study 1: The Friday Afternoon Invoice Fraud
A UK manufacturing company received an email from a “supplier” requesting payment for an outstanding invoice. The email came from an address nearly identical to their supplier but with one letter changed. The finance team, rushing to complete payments before the weekend, failed to notice the discrepancy and transferred £43,000 to the fraudulent account. The fraud was only discovered when the real supplier followed up on the unpaid invoice the following week.
Lesson: Always verify payment changes through a separate channel, and be especially cautious of urgent requests received on Friday afternoons.
Case Study 2: CEO Holiday Scam
While the CEO of a marketing agency was on holiday, employees received emails appearing to come from their boss, requesting an urgent wire transfer for a “confidential acquisition opportunity.” The attackers had monitored the CEO’s social media, noting their absence, and crafted an email that mimicked the executive’s writing style. A finance officer, not wanting to disappoint the CEO, transferred £67,000 before contacting them directly.
Lesson: Establish clear protocols for approving unusual or unexpected financial requests, regardless of who appears to be making them.
Case Study 3: Supplier Payment Redirection
An accounting firm’s email system was compromised through a phishing attack. The attackers monitored communications for weeks before intercepting legitimate invoice emails from a regular supplier. They modified the banking details on the invoice and forwarded it to the accounts payable department, resulting in a £29,000 payment to the fraudulent account.
Lesson: Implement formal verification procedures for any changes to supplier payment details, no matter how legitimate the communication appears.
Business email compromise is one of the biggest financial threats to organisations today. Its combination of technical deception and sophisticated social engineering makes it particularly dangerous and difficult to detect.
By understanding the warning signs, implementing robust prevention measures, and creating a security-conscious culture, your organisation can significantly reduce the risk of falling victim to these costly attacks. Effective protection requires a multi-layered approach combining technology, processes, and people. If you suspect a BEC attack has targeted your organisation, act quickly. The faster you respond, the better your chances of preventing financial loss and minimising damage.
Stay vigilant, keep your security measures up to date, and ensure your team understands both the threat and their role in protecting against it. Awareness and preparation are your strongest defences in the constantly evolving landscape of cyber threats.