What BEC looks like
Business email compromise uses apparently legitimate business communications to manipulate transactions or disclosure. The FBI describes spoofed addresses, compromised accounts and fraudulent instructions that appear to come from trusted parties. A message need not contain malware for the request to be dangerous. [FBI: business email compromise]
Three identities to distinguish
| Pattern | What needs investigation |
|---|---|
| Display-name impersonation | The shown name versus the actual sending identity |
| Lookalike domain | A different domain resembling the expected organisation |
| Compromised legitimate account | An authorised account being used by an attacker |
Authentication is not a verdict that the business request is legitimate. See DMARC’s scope.
Protect the transaction as well as the mailbox
The FBI advises independent verification of payment and account changes using a trusted contact route, not contact details supplied in the suspicious message. If funds were transferred, contact the financial institution immediately and follow the applicable reporting route. [FBI: business email compromise]
NCSC’s business-payment-fraud guidance provides the UK response context. [NCSC: business payment fraud]
The email-security contribution
User and domain impersonation controls can add protection for executives, finance roles and sensitive partners. Microsoft exposes these through specific anti-phishing policy features, with licensing and configuration dependencies. [Microsoft: anti-phishing policies]
Our proposed review combines selected high-risk identities, provider routes, reporting, payment-verification ownership and incident handling. We test false positives with authorised business samples before widening enforcement. A security gateway contributes to this defence; the payment approval process remains essential.
Primary sources
Provider requirements and product capabilities can change. Check the linked source before a production change.