Business Email Compromise: How Impersonation Scams Work

Business email compromise, often shortened to BEC, is fraud in which criminals impersonate an executive, supplier, customer or business partner by email. Their aim is to persuade an employee to send money, change bank details, disclose information or take another action that benefits the attacker.

The messages rarely look like obvious spam. They are designed to fit ordinary business processes: a supplier invoice, an urgent request from a senior executive, or a payroll update from an employee. The fraud succeeds when a recipient accepts the apparent identity of the sender without independently checking it.

How business email compromise works

A BEC attack usually begins with research. Criminals may study company websites, social media, public filings and previous data breaches to identify finance staff, executives, suppliers and upcoming transactions. They then send a convincing message from a spoofed address, a lookalike domain, or a genuine account that they have taken over.

In some cases, attackers compromise a real mailbox using stolen passwords, phishing or session theft. They can read email threads, learn invoicing language and wait until a payment is due. A request sent from a genuine supplier account can be especially difficult to spot, but it still needs verification when payment instructions change.

Common BEC variants

• CEO fraud: An attacker poses as a chief executive or other senior leader and instructs an employee to make a confidential, urgent payment. The message may ask the employee to bypass normal approval procedures.
• Fake supplier invoices or changed bank details: A criminal sends an invoice, or claims that a supplier has moved banks and asks for future payments to be sent to a new account.
• Compromised real accounts: The attacker gains access to a supplier, customer or employee mailbox and sends requests within legitimate email conversations.
• Lookalike domains: The sender address closely resembles a real company domain, perhaps by changing one character or using a different top-level domain. At a glance, it can appear authentic.
• Payroll diversion: A fraudster impersonates an employee and asks human resources or payroll to change the bank account receiving wages.

Why these scams are persuasive

BEC relies more on social engineering than on malicious attachments. Social engineering is the use of psychological pressure or deception to influence a person. A request may invoke authority, such as an instruction from a manager; urgency, such as a payment deadline; and secrecy, such as an alleged acquisition or legal matter.

The payment can also look routine. Finance teams process many invoices and account updates, often under time pressure. An attacker who knows a supplier name, invoice amount or project reference can make a fraudulent request blend into normal work. That is why spotting spelling mistakes alone is not a reliable defence.

Controls that reduce the risk

The most important control is independent verification of any new or changed payment instruction. Do not reply to the email, use a phone number contained in it, or follow a link supplied by the requester. Instead, call a known contact using a number from an existing contract, official website or trusted internal directory. Confirm both the request and the bank details.

• Require dual approval for payments, especially new beneficiaries, changes to supplier bank details and high-value or unusual transfers. Separate the person who creates a payment from the person who approves it.
• Use confirmation-of-payee or payee-name checks where available. These services compare the account name entered by the payer with the name held by the receiving bank, helping identify some mismatches. A match is useful evidence, not a substitute for verifying a change request.
• Deploy email authentication. DMARC, or Domain-based Message Authentication, Reporting and Conformance, helps domain owners tell receiving mail systems how to handle messages that fail authentication checks. It works with SPF and DKIM, which help validate permitted senders and message integrity.
• Train staff to pause when a request changes payment details, bypasses a process, demands secrecy or creates unusual urgency. Training should include realistic reporting routes and regular exercises.
• Use multi-factor authentication, strong access controls and monitoring for email accounts. These measures reduce the chance that an attacker can use a real mailbox to send fraudulent instructions.

The identity verification problem

At its core, BEC is an identity problem: the recipient must establish who is really making the request and whether that person is authorized to do so. An email display name, familiar signature or apparently legitimate address is not enough for a high-risk action such as moving funds or changing payroll instructions.

AI-generated voice cloning and deepfake video raise the stakes. An attacker may pair an email with a phone call that sounds like an executive, or a video meeting that appears to show a known colleague. These tools can make impersonation more credible, but they do not change the central response: verify through a separate, pre-agreed channel and follow documented approval controls. Organizations can also establish payment code words or call-back procedures, but these should not replace robust authorization and verification.

What to do after a suspected BEC incident

Act immediately. Contact the bank or payment provider and ask whether the transfer can be stopped, recalled or traced. The sooner the report is made, the greater the chance that funds can be frozen before they are moved onward. Preserve the emails, headers, invoices, payment records and relevant account logs, but do not continue communicating with the suspected fraudster.

Notify internal security, finance, legal and incident-response teams. Report the matter to the relevant authorities and national fraud-reporting service. In the United States, this may include the FBI's Internet Crime Complaint Center and local law enforcement. In EU member states, reporting routes vary, but police, national cybercrime bodies and the affected bank are key contacts. If personal data may have been exposed, assess applicable data-protection notification obligations as well.