A finance manager receives an email from the managing director asking for an urgent supplier payment before a deadline. The name looks right, the tone is familiar and the bank details appear plausible. But the message did not come from the managing director. It came from a criminal who has been watching the business closely.
If you are asking what is BEC, it means Business Email Compromise. It is a targeted fraud where criminals use email to impersonate a trusted person, supplier or organisation in order to steal money, sensitive information or account access. For UK businesses, it is one of the most damaging forms of phishing because it exploits ordinary working processes rather than relying solely on technical tricks.
What is BEC and why is it different from ordinary phishing?
Phishing is a broad term for deceptive messages designed to make someone click a link, open a file or share information. BEC is more focused. The attacker usually has a specific outcome in mind, such as changing a supplier’s bank details, convincing payroll to amend a salary payment, or obtaining copies of invoices and customer records.
A BEC attack may begin with a phishing email, but it can also involve a compromised Microsoft 365 account, a lookalike email address or information gathered from public websites and social media. Criminals may spend days or weeks learning who approves payments, which suppliers the business uses and how senior people communicate.
That preparation makes BEC convincing. The email may not contain a suspicious attachment or obvious malware. It may simply be a short request: “Can you deal with this urgently?” In a busy office, particularly where teams work remotely or across several locations, that can be enough to bypass normal caution.
How business email compromise attacks work
Most BEC attacks follow a recognisable pattern. First, the criminal identifies a target and gathers information about staff, suppliers, projects and financial processes. They may use details published on company websites, professional networking profiles, previous data breaches or emails taken from a compromised account.
Next, they create credibility. This could mean registering a domain that differs by one character from the genuine address, such as replacing a letter with a number. In other cases, they gain access to a real mailbox and monitor conversations without being noticed. Because the message then comes from a genuine account, it can be particularly difficult to spot.
Finally, they make the request. Common examples include an urgent payment to a new bank account, a request for gift cards, a change to payroll details, or a demand for confidential documents. The criminal often applies pressure through urgency, confidentiality or seniority. They want the recipient to act before checking.
The most common BEC scenarios
Supplier invoice fraud is one of the best-known examples. An attacker impersonates an existing supplier, or intercepts an email chain, and asks the accounts team to use revised bank details. A legitimate-looking invoice may be attached, sometimes using real branding and details copied from earlier correspondence.
CEO fraud works differently. A criminal impersonates a director or partner and sends an urgent request to an employee with access to payments or confidential information. The message may arrive when the senior person is travelling, in a meeting or known to be unavailable.
Payroll diversion targets HR or finance teams. The attacker poses as an employee and asks for salary payments to be redirected. Account takeover is another serious risk, where access to a mailbox allows criminals to reset passwords, impersonate staff and use trusted conversations to target customers or suppliers.
Why BEC is a serious risk for smaller businesses
Criminals do not only target large corporations. Small and medium-sized businesses can be attractive because they often have lean finance teams, informal approval processes and limited time to investigate every unusual request. A business does not need to process millions of pounds each month to be worth targeting.
The direct financial loss can be significant, but it is rarely the only consequence. A fraudulent payment can disrupt cash flow, delay legitimate suppliers and create difficult conversations with customers or partners. If personal data or commercially sensitive information is exposed, the business may also face contractual, regulatory and reputational pressure.
For regulated firms, professional services practices and organisations handling customer data, the effect may extend beyond the initial incident. Leaders need to understand what information was accessed, whether it was shared externally and whether reporting obligations apply. That creates stress at exactly the point when the business needs to keep operating.
Warning signs your team should not ignore
BEC messages are designed to look normal, so no single warning sign proves fraud. However, staff should pause when a request is unusual, particularly where money, credentials or sensitive information are involved.
Be cautious if an email asks for a change to bank details, a payment outside the usual process, secrecy, an urgent response or a request made while the sender is supposedly unavailable. Check the full sender address, not just the display name. A subtle spelling change can be easy to miss on a mobile phone.
Language can also provide clues. A senior colleague may use an unfamiliar tone, make an unusual request or avoid a normal greeting. Equally, do not assume a well-written email is safe. Criminal groups increasingly use accurate grammar, copied signatures and real details from previous messages.
The right response is not to reply to the email and ask whether it is genuine. If the mailbox is compromised, the criminal may answer. Instead, verify the request using a known phone number, an existing supplier contact or another trusted channel.
How to reduce the risk of BEC
BEC protection works best when payment processes, technical controls and staff confidence support each other. There is no single product that removes every risk, but the right combination can make an attack far harder to carry out.
Make payment verification a business process
A bank detail change should never be confirmed only by email. Require an independent check using contact information already held by the business, and record who completed it. For higher-value payments, use dual authorisation so one person creates the payment and another approves it.
This can add a little friction, and that is a worthwhile trade-off. A short verification call is far less disruptive than trying to recover funds sent to a criminal account. The process should apply consistently, including when a request appears to come from a director.
Protect email accounts properly
Multi-factor authentication is one of the most effective controls against account takeover. It means a stolen password alone is less likely to give a criminal access to Microsoft 365 or another email platform. Strong, unique passwords and credential management also reduce the risk of password reuse turning one breach into several.
Email protection can help identify impersonation attempts, malicious links and suspicious messages before they reach staff. Domain protection settings can reduce the chance of criminals spoofing your organisation’s email address. Monitoring for exposed credentials and unusual sign-in activity adds another layer of early warning.
Technical controls need to be configured and reviewed, not simply purchased. Rules, alerts and access permissions should reflect how your business actually works, including remote staff, shared mailboxes and third-party suppliers.
Give staff practical, relevant training
Awareness training should help people make good decisions under pressure, not make them fearful of every email. Use examples that reflect the requests your teams genuinely receive: invoice queries, document-sharing requests, payroll changes and urgent messages from senior colleagues.
Staff need a simple route to report suspicious messages without feeling embarrassed. A fast question to IT or the finance lead can prevent a loss. Simulated phishing exercises can be useful when they are constructive and followed by clear guidance, rather than used to catch people out.
What to do if you suspect a BEC attack
Act quickly, but avoid deleting evidence. If money has been sent, contact the bank immediately and ask it to recall or freeze the payment where possible. Notify the relevant internal decision-makers, preserve the suspicious emails and check whether other messages, payment requests or accounts may be affected.
If an email account may have been compromised, reset credentials, revoke active sessions and review mailbox rules, forwarding settings and sign-in activity. Criminals sometimes create hidden rules to divert messages or conceal replies from genuine suppliers.
You may also need to tell affected customers, suppliers, insurers or regulators, depending on the information involved and the terms of your contracts. Getting early technical advice can help establish the scope of the incident and prevent a second attack while the first is being investigated.
BEC succeeds when normal business trust is turned against the organisation. The practical answer is not to make every employee a cybersecurity specialist. It is to give them clear checks, sensible protection and a real person to call when something does not feel right. That is one less thing for business leaders to worry about, and one more safeguard for the work that keeps the business moving.