The short answer
Business email compromise (BEC) is fraud in which a criminal sends email from a hacked or faked account, usually a supplier, colleague or senior manager, to persuade staff to pay money into the wrong bank account or hand over data. It relies on trust rather than malware, so a call-back check before any bank detail change is the strongest defence.
On this page
Business email compromise (BEC) is fraud carried out through email: the criminal takes over or imitates an account your staff trust, and asks for a payment, new bank details or confidential data. There is often no malicious link or attachment, so filters miss it. The NCSC covers it in its advice on business payment fraud. For related terms, see the cyber security glossary.
How does business email compromise work?
Business email compromise abuses trust in an existing relationship rather than breaking technology. The criminal either takes over a real mailbox, usually with a Microsoft 365 password stolen through a fake sign-in page, or imitates one with a lookalike domain or a display name that matches your finance director. They then send a request that fits the normal flow of business, so neither the email filter nor the person reading it sees anything unusual.
MFA helps, but adversary-in-the-middle phishing kits relay the real sign-in page and capture the session once MFA is complete, so text or app codes alone do not stop them.
What are the stages of a BEC attack?
The first stage of a BEC attack is reconnaissance, and the request for money only comes at stage four, so there are several chances to stop an attack before any payment moves. Most attacks follow five stages:
| Stage | What the criminal does | Where you can stop it |
|---|---|---|
| 1. Reconnaissance | Researches who approves payments, which suppliers you use and when invoices are paid, from your website, social media, company filings and earlier data breaches | Limit what you publish about finance roles and payment processes, and tell finance staff they are targets |
| 2. Mailbox compromise or spoofed domain | Steals a password through a fake sign-in page, or registers a lookalike domain or sets a matching display name | Phishing-resistant MFA, a DMARC policy on your own domain, external email tagging |
| 3. Hiding in the mailbox | Adds inbox rules that move or delete replies, sets up forwarding and reads threads to learn who pays whom | Block automatic external forwarding and alert on new inbox rules |
| 4. The payment or data request | Sends a routine-looking request at a natural moment, such as an invoice run or a director’s holiday | A call-back check on a number you already hold, and two-person approval |
| 5. Cash-out | Moves the money on quickly through other accounts, often abroad, before anyone notices | Call your bank at once so it can try to stop or recall the payment |
Stages 2 and 3 are skipped when the criminal only impersonates someone from outside, as in most CEO fraud, which is why the payment checks at stage 4 matter more than any single email setting.
What are the main types of BEC attack?
| Type | Who is impersonated | What they ask for | The check that stops it |
|---|---|---|---|
| Invoice redirection (mandate fraud) | A real supplier, often from its own hacked mailbox | Pay this invoice to a “new” bank account | Call the supplier on a number already on file before changing bank details |
| CEO or director fraud | A senior manager, by display name or lookalike domain | An urgent, confidential transfer or gift cards | A payment rule nobody can override by email, however senior |
| Payroll diversion | An employee | Change my salary account | Confirm changes in person or through the HR system |
| Conveyancing fraud | A solicitor or estate agent | Send the deposit or completion funds to new details | Confirm account details by phone at the start, never mid-thread |
| Data theft | HR or a director | Staff records, payroll files or customer lists | Verify bulk data requests the same way as payments |
How does invoice fraud email work?
It is hard to spot because almost everything is real. When a supplier’s mailbox is compromised, the message comes from their genuine address, sits in an existing thread and quotes a real invoice number and amount. Only the bank account changes, and nobody notices until the supplier chases payment weeks later.
It also works in reverse: if your mailbox is compromised, your customers pay the criminal. In CIA triad terms, invoice redirection is an integrity attack: the payment instruction is altered while everything around it stays genuine.
How do you prevent business email compromise?
Combine a payment process that never trusts email alone with settings that make impersonation and account takeover harder.
Payment controls
- Verify every new payee or bank detail change by phoning a number you already hold, never one from the email or an attached letter.
- Require two people to approve new payees and changes.
- Use the Confirmation of Payee check your bank runs when you add a payee, and treat a “no match” result as a reason to stop.
- Tell suppliers and customers you will never change bank details by email.
Email and Microsoft 365 controls
- Publish SPF, DKIM and a DMARC policy of quarantine or reject so criminals cannot easily send email as your exact domain.
- Enforce MFA on every account, using phishing-resistant methods such as passkeys for finance and admin users.
- Block automatic forwarding to external addresses and alert on new inbox rules that forward, move or delete mail.
- Turn on impersonation protection for key people and domains where your licence includes it, and tag external email.
A Microsoft 365 security assessment checks these settings and tests what an attacker could do from one compromised mailbox. To see whether staff follow the payment process under pressure, a phishing simulation can use the payment-change and urgent director requests typical of spear phishing. Smaller firms can start with our small business cyber security plan.
How do you report business email compromise in the UK?
Act fast; speed decides whether money comes back:
- Call your bank on its published number to stop or recall the payment.
- Report the fraud to Report Fraud (England, Wales and Northern Ireland) at reportfraud.police.uk or on 0300 123 2040, or to Police Scotland on 101. Report Fraud replaced Action Fraud in December 2025.
- Secure the mailbox. Reset the password, sign out all sessions, remove rogue inbox rules and forwarding, and check for MFA methods the attacker added.
For the other UK routes, including forwarding the email itself to the NCSC and when to tell the ICO about exposed personal data, see how to report phishing in the UK.
Why Sovereign Secure?
We test the controls that stand between a criminal and your accounts team: Microsoft 365 configuration, cloud services, and staff through phishing and social engineering testing. Sovereign Secure is a PCI SSC Qualified Security Assessor company and ISO 27001 certified. For card businesses, we relate findings to PCI DSS v4.0.1 Requirements 5.4.1 (anti-phishing mechanisms) and 12.6.3.1 (phishing awareness training).
Next step: request a penetration testing quote covering your Microsoft 365 tenant, a phishing campaign or both.
Your next step
- Phishing simulationRealistic email, QR code and vishing campaigns, reported by team rather than by name.See phishing simulation
- Social engineeringPhishing, phone and on-site pretext tests that show how your staff respond.See how we test
- Scope your testChoose your channels online to scope a phishing or social engineering test.Scope your test
Last reviewed October 2026 by the Sovereign Secure assessment team.
