Business Email Compromise: How Payment and Impersonation Fraud Actually Works

Business Email Compromise (BEC) is fraud built around trust. The attacker may compromise a real mailbox or impersonate a supplier, manager or client closely enough that the request feels routine.

The objective is often a payment, bank-detail change, confidential document or credential - and the message may contain no malware at all.

Why BEC is difficult to filter

If an attacker controls a legitimate mailbox, the message can come from the correct address inside an existing conversation. Even impersonation from a lookalike domain can be convincing when the attacker has researched the people and timing.

Common BEC patterns

• A supplier asks for bank details to be changed before the next payment.
• A manager requests an urgent confidential transfer.
• An existing email thread is hijacked and payment instructions are altered.
• A compromised mailbox is used to send a convincing login or document-sharing request to colleagues and clients.

The strongest control is often a business process

Any bank-account change or unusual payment request should be verified using a trusted channel that does not rely on the same email thread. Call the supplier on a known number, use an established approval workflow, or require a second person to verify changes above an agreed threshold.

Technical controls still matter

Strong MFA, Conditional Access, email filtering, DMARC, mailbox-rule monitoring and rapid incident response all reduce the likelihood or impact of account compromise and impersonation.

Our business email security guide covers those technical controls. The invoice-fraud article goes deeper on payment verification and AI-assisted impersonation.

If somebody has acted on a suspicious payment request, contact the bank and your IT/security provider immediately. For wider prevention, use the Security Self-Check or review our managed cyber-security service.