Business email compromise (BEC)
A fraud in which criminals take over or impersonate a business email account to trick staff into making payments or changing bank details.
Business email compromise (BEC) is fraud carried out through email that appears to come from a trusted source: a supplier, a director or a colleague. The fraudster either gains access to a genuine mailbox or uses a lookalike address, then sends a convincing request, most often to pay an invoice to new bank details or to make an urgent transfer.
It is effective because it exploits normal process rather than breaking it. When a compromised supplier mailbox is used, the email sits in a real thread, references real invoices and uses the supplier's own formatting. Staff following the instructions believe they are doing their job correctly.
Email security reduces the risk but cannot remove it, because the underlying weakness is that bank details and payment instructions are being agreed over an insecure channel. Taking those changes out of email entirely, and verifying bank details against an independent, verified source before paying, is what breaks the pattern.