Business email compromise is fraud carried out through email, where an attacker impersonates someone you trust or takes over a real mailbox to trick your team into sending money or sensitive data. Your MSP should already be stopping most of it with strong sign-in protection, email filtering, alerting on suspicious mailbox activity, and a payment verification process that does not depend on anyone noticing a typo.
Business email compromise, often shortened to BEC, is less about malware and more about persuasion. It works because it looks like ordinary business: an invoice, a change of bank details, an urgent request from the boss. The FBI’s Internet Crime Complaint Center describes BEC as a scam aimed at businesses and individuals that make legitimate transfer-of-funds requests, and it tracks the losses in its public service announcements. This guide is written for business owners and leaders. It explains how these attacks work, what a capable MSP should be doing about them, and what your own team must do that no technology can do for you.
How Business Email Compromise Works
There are two common patterns. In the first, an attacker impersonates someone, such as an executive, a vendor, or a client, using a look-alike email address or a spoofed display name. They send a believable request: pay this invoice, buy gift cards, update our bank account. In the second, an attacker actually gains access to a real mailbox, often by stealing a password through a phishing page. They read the conversation for days or weeks, learn how payments are discussed, and then insert a fraudulent request into a real thread.
The second pattern is more dangerous because the message comes from a genuine account in an ongoing conversation. Attackers sometimes create hidden inbox rules that move replies out of sight, so the real person never sees the fraud unfolding.
Why It Hurts So Much
Money sent through a fraudulent transfer is hard to recover, and speed matters. Beyond the direct loss, a compromise can expose customer data, damage client trust, trigger notification duties, and consume days of staff time. Because there may be no malware at all, traditional antivirus does not help. The defense has to combine technology, process, and people.
What Your MSP Should Already Be Doing
Ask your provider to confirm each of these. A capable MSP will answer plainly and show evidence.
- Multifactor authentication on every mailbox, with legacy sign-in methods that bypass it turned off.
- Modern email filtering that catches impersonation, look-alike domains, and malicious links.
- Email authentication records set up correctly for your domain, so attackers cannot easily send as you.
- Alerts for suspicious sign-ins, such as logins from unusual locations or impossible travel.
- Alerts for risky mailbox changes, such as new forwarding rules or rules that delete or hide messages.
- External sender warnings so users can see when a message comes from outside.
- Security awareness training with regular phishing simulations.
- A response plan that lets you lock an account, reset credentials, and review activity quickly.
If your provider cannot describe these, that is worth raising at your next review. A vCIO who runs regular business reviews should be asking these questions before you do. See what a vCIO is and why the role matters for how that advisory relationship should work.
What Technology Cannot Do for You
The last line of defense is a process. Any request to change payment details or to send money outside the normal flow should be verified by a call to a known phone number, not the number in the email. Set a second approver for payments above a threshold. Treat urgency and secrecy as warning signs. Make it safe for staff to slow down and ask, even when the request appears to come from the owner. Attackers rely on employees being afraid to question authority.
A Realistic Scenario
Picture a bookkeeper at a small contractor. An email arrives from a supplier the company pays every month, saying that its bank has changed and future payments should go to a new account. The email is polite, uses the supplier’s real signature, and arrives in the middle of an existing thread about an open invoice. The bookkeeper updates the vendor record and the next payment goes to the attacker. The supplier’s mailbox had been compromised weeks earlier, and nothing in the message looked wrong. What would have stopped it was not a sharper eye, but a rule: any change to bank details is confirmed by phone using a number already on file, before the record is edited. The rule costs a few minutes and removes the dependence on spotting a forgery.
Warning Signs to Teach Your Team
- A request that pushes speed and discourages phone calls.
- A slightly different email address or domain.
- A change in bank details or payment method for a known vendor.
- A message that arrives when the real sender is traveling or unavailable.
- Language that does not sound like the person who supposedly wrote it.
What to Do in the First Hour of a Suspected Compromise
Speed reduces damage. If you think a mailbox is compromised or a fraudulent payment was sent, act immediately.
- Call your bank and ask to recall or freeze the transfer. Time is critical.
- Contact your MSP so they can lock the account, reset credentials, and end active sessions.
- Have the MSP check for inbox rules, forwarding settings, and other changes the attacker may have made.
- Preserve evidence and avoid deleting messages.
- Notify leadership, your insurance broker, and, where appropriate, law enforcement and legal counsel.
- Warn clients or vendors who may have received fraudulent messages from your account.
Practice this sequence ahead of time. A five-minute tabletop conversation once a year makes the real event far less chaotic.
Involve Finance and Leadership
BEC is a business risk, not only an IT one. Finance staff need clear procedures and the authority to pause a payment. Leaders must back them when they slow down a request that seems to come from the top. Review the payment approval process with your MSP and your accountant once a year, and document it. Add BEC scenarios to staff training, using examples that match your own vendors and workflows.
Insurance and Legal Considerations
Review how your policies treat fraudulent transfers. Coverage for social engineering losses varies widely, and some policies limit it or require specific verification steps. Ask your broker directly, and read the requirements. Your attorney can advise on notification duties if customer information was exposed.
Measure Whether Defenses Work
Track phishing simulation results, the number of reported suspicious messages, how quickly reports are triaged, and how many risky sign-ins are blocked. A rise in reports is a good sign, because it means people are paying attention. Share the results at your regular reviews so leadership can see progress and decide where to invest next.
Build Protection Into Your Roadmap
Email security is not a one-time project. Review it during your regular business reviews and keep it on your technology roadmap. Tools, threats, and your own business change, and a control that was strong two years ago may have gaps today.
Common BEC Defense Mistakes
- Assuming antivirus stops email fraud.
- Leaving multifactor authentication off for a few executives.
- Verifying payment changes by replying to the same email thread.
- Never testing staff with realistic simulations.
- Having no plan for the first hour after discovery.
Related Reading
New to the role? Start with what a vCIO is and why the role matters, then see how the vCIO services hub ties the pieces together.
Frequently Asked Questions
What is business email compromise?
It is fraud that uses email impersonation or a hijacked mailbox to trick people into sending money or sensitive information.
How is BEC different from phishing?
Phishing is often a mass message that tries to steal credentials or install malware. BEC is targeted, often involves no malware, and aims at a payment or data transfer.
What is the best defense against business email compromise?
Layered protection: multifactor authentication, email filtering, alerting on risky mailbox changes, training, and a call-back rule for payment changes.
What should you do if you sent money to a fraudster?
Contact your bank immediately to try to recall the transfer, then involve your IT provider, insurance broker, and legal counsel.
Does cyber insurance cover email fraud?
It depends on the policy. Social engineering coverage is often limited or conditional, so ask your broker to explain how your policy treats it.
About Brent Lacy: Brent Lacy is a technology advisor and the voice behind Rewired MSP. He helps MSPs operate with greater maturity and helps business owners make IT choices that make them more secure and more efficient. He is the author of Out of Cycle: A Field Guide to Strategic IT Continuity, vCIO Rewired: Virtually Conquering IT Obstacles, and Near Miss: Preventable IT Failures Threatening Your Business Security.
