Business Email Compromise (BEC): The Most Expensive Social Engineering Attack

Business Email Compromise (BEC) is one of the technically “simplest” but financially most devastating attacks. It requires no malware or vulnerability; instead it exploits trust and authority. The typical scenario: an attacker posing as an executive or supplier sends a fake payment instruction to finance, and money is transferred to the attacker’s account. Losses frequently reach large sums.

How BEC works

• Identity impersonation: The attacker sends an email that appears to come from a CEO, executive or supplier. This may use a look-alike domain or a genuinely compromised account.
• Urgency and authority: The message usually applies pressure through urgency (“must be paid today”), secrecy (“don’t discuss this with anyone”) and authority (senior management), pushing the victim to skip normal controls.
• Fake instruction: A payment, a bank-account change or sensitive information is requested.

BEC bypasses most technical defences because it may contain no malicious file or link — just persuasive text.

Defence: technical + process

Technical measures alone are not enough; BEC is a process vulnerability.

Technical:

• SPF/DKIM/DMARC to make impersonating your domain harder (DMARC reject is especially important).
• External email warnings: Visually flag emails from outside the organisation.
• Look-alike domain monitoring.

Process (the most critical):

• Second-channel verification for payment/bank changes: Verify a payment instruction or account change through a channel independent of email (by phone, using a known number). This single rule stops most BEC.
• Approval thresholds: Multi-person approval for payments above a set amount.
• Employee awareness: Teach that the combination of urgency + secrecy + authority is a warning sign.

Summary

BEC is a social-engineering attack that exploits trust and authority rather than malware, and is among the most expensive types. Defence has two legs: technically, SPF/DKIM/DMARC to make impersonation harder; and — most effective — a process that verifies payment/account changes through a second channel independent of email.

Sources: FBI: Business Email Compromise, CISA: Social engineering.

Are the SPF/DKIM/DMARC records that make domain impersonation harder complete for your domain? CyberTestify’s external surface scan checks your email authentication records.