It starts with a simple email: "Are you at your desk? I need a wire transfer processed immediately." The sender looks like your CEO. The request is urgent. But it's a lie that costs businesses billions every year.
What is BEC?
Business Email Compromise (BEC) is a type of cybercrime where an attacker compromises legitimate business email accounts or uses spoofing to conduct unauthorized transfers of funds.
Unlike ransomware or viruses, BEC attacks rarely use malicious links or attachments. They rely purely on Social Engineering—manipulating people into making a mistake.
The Two Main Flavors
1. CEO Fraud
The attacker pretends to be a high-level executive (CEO, CFO) and emails an employee in the finance department.
- The Hook: "I'm in a meeting / on a plane and can't talk."
- The Ask: "Process this urgent vendor payment focusing on confidentiality."
- The Target: Junior employees who are afraid to say "no" to the boss.
2. Vendor Invoice Fraud
The attacker compromises the email account of a real vendor you work with. They monitor the email threads, waiting for an invoice to be sent.
At the last moment, they intercept the conversation:
"Hi, our bank details have changed due to an audit. Please send payment to this new account number..."
This is devastating because the email comes from the real vendor's address (since they were hacked). No spam filter will catch it.
Red Flags to Watch For
1. Extreme Urgency
"Do this immediately", "Confidential", "Before the cutoff time". Scammers need you to act fast so you don't think.
2. "Can't talk right now"
The scammer claims to be unreachable by phone to prevent you from verifying the request.
How to Protect Yourself
The best defense against BEC is a simple process change: Always verify out-of-band.
If you receive a request to change bank details or wire money:
- Do NOT reply to the email.
- Call the person/vendor on a trusted phone number (from your internal directory or their website, not the email signature).
- Verify the request verbally.
Technical Defense
While BEC relies on psychology, header analysis can still catch them.
- Mismatched Reply-To: The "From" address says
[email protected], but the hidden "Reply-To" header goes to[email protected]. - Look-alike Domains: The email comes from
[email protected](typo-squatting).
Caught a Suspicious "CEO" Email?
Before you reply, check the headers for a mismatched Reply-To address. Our tool surfaces these red flags in seconds.
Analyze Header Mismatches