An attacker never touches your firewall, never drops a payload, never trips your EDR. They read your emails for three weeks, learn who approves vendor payments and how, then send one message at exactly the right moment. Your finance team wires $340,000 to a bank account that isn’t your supplier’s. Nothing was “hacked” in the way your incident response playbook expects.

TL;DR

  • Business Email Compromise (BEC) caused $3.05 billion in reported US losses in 2025 (24,768 FBI IC3 complaints) — IC3’s second-largest cyber-enabled fraud loss category after investment fraud, and far ahead of reported ransomware losses.
  • 86% of BEC losses move via wire transfer or ACH — fast, and usually gone before anyone notices.
  • The core technique is Vendor Email Compromise (VEC): hijack a real invoice thread, wait for the right moment in the payment cycle, then insert a “updated bank details” message that looks exactly like the last twenty emails in that thread.
  • DMARC stops domain spoofing. It does not stop a real, compromised mailbox sending real email from a real domain — which is how most BEC succeeds.
  • The single most effective control is boring: a mandatory out-of-band callback, on a known phone number, before any bank detail change — not a technical control at all.

Why This Matters to You

If your organization pays vendors, runs payroll, or has a finance team with wire authority, you’re a target regardless of size. BEC doesn’t need zero-days or expensive tooling — it needs patience and a plausible story, which makes it accessible to a much wider range of attackers than ransomware crews, and much harder for traditional security tooling to catch because nothing “malicious” ever executes.

Table of Contents

What BEC Actually Is

Business Email Compromise is targeted fraud where an attacker impersonates an executive, vendor, or trusted partner — usually from a real or convincingly spoofed mailbox — to redirect a payment or extract sensitive data. There’s no malware requirement in the definition at all. The FBI’s IC3 data makes the scale hard to dismiss: BEC generated $3.05 billion in reported US losses in 2025, and the FBI has separately warned that global exposed losses tied to BEC passed $55 billion across the 2013-2023 reporting window.

The reason it works isn’t sophistication — it’s that BEC targets a process, not a system. Wire transfers, invoice approvals, and payroll changes are business-as-usual actions that legitimate emails trigger constantly. An attacker who can insert one convincing message into that flow doesn’t need to break anything technical at all.

The Attack Chain

BEC follows a consistent structure, whether the target is a $50,000 payroll redirect or a $25 million wire:

1. Initial access — phishing, credential stuffing, or purchased
   infostealer logs get the attacker into one mailbox (often
   finance, procurement, or an executive assistant account)
2. Reconnaissance — attacker reads (doesn't touch) the mailbox:
   org chart, who approves what, vendor relationships,
   payment schedules, writing style and tone
3. Positioning — attacker sets up an inbox rule to silently
   forward or hide replies related to the target thread,
   so the real employee never sees the fraudulent exchange
4. The ask — a message arrives at exactly the right moment
   in a real, ongoing conversation: "updated bank details,"
   "urgent wire needed before close of business," or a
   spoofed executive requesting a gift-card purchase
5. Payout — wire transfer or ACH payment goes to an account
   the attacker controls, often a mule account that moves
   funds within hours

Step 3 is the part most defenders underestimate. A single malicious inbox rule — forward all mail matching “invoice” to an external address, or silently delete replies from the real vendor — lets an attacker sit inside a live conversation indefinitely without the account owner noticing anything unusual in their own inbox.

Vendor Email Compromise: The Most Damaging Variant

Vendor Email Compromise (VEC) — sometimes treated as a BEC subtype — is where the largest losses concentrate, because it exploits an existing trust relationship instead of building a fake one from scratch.

The attacker doesn’t need to compromise your mailbox — compromising your supplier’s is just as effective, sometimes more so, because you have no reason to doubt a message that continues a real thread with your actual vendor’s actual email address. The recurring pattern in public BEC cases is simple: attackers monitor a real payment relationship, wait for an invoice or remittance discussion, then insert a legitimate-looking bank-detail change into a thread that already has trust and business context. If the wire is approved without an independent callback, the technical quality of the email barely matters.

That last detail is the whole story. Every technical control in place — spam filtering, antivirus, even DMARC — was irrelevant, because the email was real, from a real (compromised) account, continuing a real conversation. The only thing that would have stopped it was a phone call to a number that wasn’t in the email.

Attackers also time VEC deliberately. Fiscal quarter-end, year-end, and post-acquisition integration windows all see disproportionate BEC activity, because payment volumes are higher, approval chains are more likely to include unfamiliar new counterparties, and “this is urgent, close it before month-end” reads as completely normal business pressure rather than a red flag. When the attacker doesn’t have access to a real compromised mailbox, a close look-alike domain — a single transposed character, a hyphen swapped for nothing, a .co instead of .com — combined with a copied email signature and logo is usually enough to pass a distracted glance.

Beyond Wire Fraud: Other BEC Variants

Vendor Email Compromise gets the biggest headlines because of the dollar amounts, but BEC covers several distinct fraud patterns that hit organizations without a single wire transfer department:

  • Payroll diversion. An attacker impersonating an employee emails HR asking to update direct-deposit bank details “before the next pay run.” No approval workflow, no callback — payroll changes are often self-service by design, which is exactly what makes them attractive.
  • Gift card fraud. A spoofed or compromised executive account asks an assistant to “quickly” buy several gift cards for a client gift and send the codes by email or text. Small individual amounts ($500–$2,000) keep it under scrutiny thresholds, and gift card codes are effectively untraceable cash the moment they’re sent.
  • W-2 / tax data theft. Around tax season, attackers impersonating executives request bulk employee W-2 forms from HR or payroll — not for a wire transfer, but to fuel identity theft and tax refund fraud at scale.
  • Attorney impersonation. Fraudsters posing as legal counsel pressure a target into an urgent, confidential wire transfer, leaning on time pressure and the social awkwardness of questioning a lawyer.

None of these require compromising a vendor relationship — they exploit informal internal processes that were never designed with an adversarial sender in mind.

Detecting BEC in Microsoft 365 and Google Workspace

Most BEC precursors leave a log trail if you’re actually looking. Two signals are worth building alerts around specifically:

New or modified inbox rules with external forwarding or suspicious keywords (Microsoft 365, via Unified Audit Log or Search-MailboxAuditLog):

Terminal window
# Find inbox rules created/modified that forward externally
# or hide messages matching finance-related terms
Search-UnifiedAuditLog -RecordType ExchangeAdmin `
  -Operations New-InboxRule,Set-InboxRule `
  -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) |
  Where-Object { $_.AuditData -match 'ForwardTo|RedirectTo|invoice|wire|payment' }

Impossible-travel or anomalous sign-ins immediately followed by mailbox rule changes — this pairing is a strong indicator of account takeover in progress, not just a suspicious login on its own. Both Microsoft Entra ID Protection and Google Workspace’s security investigation tool surface this correlation natively; the key operational point is routing the combination of “risky sign-in” + “mailbox rule change within the same session” to a high-priority alert, rather than treating each as low-severity noise individually.

Why AI Made This Worse

The traditional BEC “tell” — awkward phrasing, wrong tone, obvious translation artifacts — is disappearing. Attackers now use generative AI to scrape public information (LinkedIn roles, press releases, earnings calls) and draft messages that match a target executive’s actual writing style, at a volume and speed no human operator could match manually. Voice-cloning tools extend the same problem to phone-based verification: a “callback” to confirm a wire request is only as strong as your certainty that the voice on the other end is real (see the AI voice cloning / vishing piece in this series for the depth on that specific angle).

The practical effect: content-based red flags — bad grammar, generic greetings, obvious urgency language — are becoming much less reliable as a detection signal than they were even two years ago.

Why Email Authentication Doesn’t Solve This

DMARC, SPF, and DKIM are worth deploying, and enforcement (p=quarantine or p=reject) is becoming a baseline expectation rather than a nice-to-have. But they solve a narrower problem than most people assume: they stop someone from sending mail that appears to come from your domain without authorization.

They do nothing for:

  • A real mailbox that’s been compromised and is sending genuinely authenticated email
  • A vendor’s compromised account sending real mail from their real, correctly-configured domain
  • An OAuth token stolen via consent phishing that gives persistent API-level access without ever touching the password
  • A human who approves a fraudulent request because the story was convincing, regardless of what the headers say

DMARC is necessary. It is nowhere close to sufficient for BEC specifically, because the entire point of BEC is that the email often isn’t forged — it’s real email from a real (if compromised) source.

MITRE ATT&CK Mapping

TacticTechniqueID
Initial AccessPhishing: Spearphishing LinkT1566.002
Credential AccessSteal Application Access TokenT1528
CollectionEmail Collection: Email Forwarding RuleT1114.003
ImpactFinancial TheftT1657

What You Can Do Today

  1. Mandate out-of-band verification for any bank detail change. A phone call to a number pulled from your own CRM or a previous invoice — never a number supplied in the email requesting the change. This single control stops the majority of successful VEC cases documented publicly.
  2. Enforce DMARC (p=reject) and monitor forwarding rules. Alert on any inbox rule that forwards mail externally or auto-deletes/moves messages matching finance-related keywords — this is the single most common BEC persistence mechanism and one of the easiest to detect with basic mailbox audit logging.
  3. Require dual approval above a threshold, with no exceptions for “urgent.” Urgency is the attacker’s primary lever — a policy that can’t be overridden by a convincing enough email removes it entirely.
  4. Watch for lookalike domains and reply-to mismatches, not just sender spoofing. vendor-co.com vs vendor–co.com, or a From: address that doesn’t match the Reply-To: — cheap checks that catch a meaningful share of attempts.
  5. Train finance and procurement specifically, not just general staff. Generic phishing awareness training rarely covers invoice-thread hijacking, which looks nothing like a typical phishing email — it looks like your actual vendor relationship.
  6. Log and alert on new mailbox rules and impossible-travel logins for accounts with payment authority — this is cheap to instrument in most mail platforms and catches the reconnaissance phase before the payout attempt.
  7. Maintain a wire-fraud response plan with your bank’s fraud department contact pre-identified. Funds recovery within the first 24–72 hours (before a mule account cashes out) is realistic; after that, recovery odds drop sharply.

Sources