What Is Business Email Compromise?

Business email compromise is fraud conducted through email impersonation, usually to redirect a payment. It carries no malware, exploits no vulnerability, and causes greater direct financial loss than any other category of cybercrime.

Because there is nothing malicious to detect, technical controls built around content scanning are largely irrelevant. The defences are procedural.

The recurring variants

Executive impersonation — an apparently urgent request from a senior figure to make a payment, typically with a reason not to follow normal process. Supplier invoice fraud — notification that a genuine vendor's bank details have changed.

Payroll diversion — an apparent employee request to change the account salary is paid into. Professional services interception — inserting into a property or legal transaction at the moment funds move.

Compromised accounts make it far worse

The most damaging version is not impersonation from outside but fraud from a genuinely compromised mailbox — the attacker's own, a supplier's, or one inside your organisation.

From there they read real correspondence, learn the terminology and the payment cycle, and insert a request at exactly the right moment, in an existing thread. Nothing about the message is forged, because it is genuine.

The one control that reliably works

Out-of-band verification for every change to payment details, using contact details already on file rather than any provided in the request. No exceptions for urgency, seniority or apparent inconvenience.

This defeats the entire category, including the compromised-mailbox variant, because it verifies through a channel the attacker does not control. Its weakness is entirely in whether people are permitted to apply it to a senior person's urgent request.

Supporting technical measures

Inbound mail authentication, so forgery of your own domain is rejected. Clear marking of external senders, which catches display name impersonation. Detection of newly created mailbox rules and forwarding, which is the standard post-compromise step.

And alerting on lookalike domains registered against your name, since typosquatting is frequently the preparation.

Responding to a successful one

Speed matters enormously. Contacting the sending bank within hours can sometimes recall a transfer; after a day or two it is usually gone. Law enforcement has mechanisms for rapid international requests, and they depend on immediate reporting.

Then establish whether a mailbox was compromised on either side, because if so the fraud will be attempted again through the same access.

Insurance, and what recovery actually looks like

Cyber and crime policies treat this inconsistently. Some cover fraudulent transfer, some exclude it as voluntary parting with funds, and some require specific controls — documented verification procedures — to have been in place.

Establishing which policy would respond, and what it requires of you, is worth doing before a loss rather than during a claim. Recovery of the funds themselves depends almost entirely on speed: hours are workable, days usually are not.

Where to start

Write down the verification procedure for payment changes, get it endorsed by leadership in writing, and make sure finance staff know they are protected in applying it. That is the whole defence.

See BEC defence and voice fraud. GuardsArm delivers security awareness training.