BEC (business email compromise)

How it differs from ordinary phishing

Most phishing wants a click. BEC wants a decision: approve this transfer, update this supplier's account number, send this payroll file. Because there is often nothing technical in the message, filters that look for bad links or attachments have little to work with, and the defence is a process rather than a control.

The sender identity is built one of three ways: a real mailbox that has been taken over, a lookalike domain that differs from the real one by a character, or a free webmail account with the executive's name as the display name.

Warning signs

• A payment, payroll or bank-detail request arrives through a new channel or with a changed process.
• The sender asks for confidentiality or discourages checking with anyone else.
• The reply-to address, the sending domain or the authentication results do not match the name shown.

Response

• Verify any request that moves money using a known phone number or an approved channel separate from the email.
• If money has moved, contact the bank immediately; recovery gets less likely with every hour.
• Preserve the message with full headers, reset any account that may be compromised, check mailbox rules and forwarding, and report the incident to the relevant authority.

Where brand protection fits

Lookalike domains registered for BEC are visible from the outside before they are used. Monitoring for new registrations that resemble your domain, and dealing with them through the registrar, removes one of the three sender-identity options before a message is ever sent.

Related terms

• CEO Fraud
• Executive impersonation
• Lookalike domain
• Phishing
• Domain monitoring