Business Email Compromise: How These Attacks Actually Work

Business Email Compromise doesn't need malware, an exploit, or a single line of code to work, just a convincing email and a moment of trust. The FBI's Internet Crime Complaint Center tracks BEC as one of the costliest categories of cybercrime it handles, precisely because it targets people and processes rather than technical vulnerabilities. IC3's own BEC page describes it plainly: a scam that compromises legitimate business email accounts, through social engineering or a genuine intrusion, to redirect a fund transfer.

The two ways in

BEC starts one of two ways. The simpler version is pure social engineering, a lookalike domain (kaza-sec.com instead of kazasec.com), a spoofed display name, or a compromised personal email account used to impersonate an executive or vendor, with no actual access to the real mailbox required. The more dangerous version starts with genuine account compromise, a phished or reused password gets an attacker into the real inbox, where they can read actual conversation history, understand real vendor relationships and payment timing, and reply from the genuine account. The second version is far harder to spot, because everything about the email, the address, the writing style, the thread it's replying in, is real.

Why it works even on alert people

BEC exploits legitimate business processes, not technical ignorance. An urgent request from "the CEO" to expedite a wire transfer, a "vendor" emailing to say their bank details changed, an "HR" email asking to update payroll direct-deposit information, each one mimics a real, unremarkable business request, timed to exploit urgency and authority rather than a lack of security awareness. Financial and HR staff are disproportionately targeted precisely because their day-to-day job is acting on exactly these kinds of requests quickly.

What stops it

• DMARC enforcement (not just monitoring) at p=reject, so a spoofed exact-domain email never reaches the inbox at all
• Out-of-band verification for any payment or banking-detail change, a phone call to a known number, not a reply to the email itself
• Mailbox rule auditing, since a real account compromise often adds a hidden forwarding or delete rule to hide the attacker's tracks
• Conditional Access and MFA on email accounts specifically, since a compromised mailbox is what makes the most convincing version of this attack possible
• A named, tested approval process for changing payment or banking details, with no single-person override

Why this shows up in a security assessment, not just training

Awareness training helps, but BEC's most dangerous form runs through a genuinely compromised account, which is a technical control failure (weak MFA enforcement, no Conditional Access, reused credentials), not a training gap. This is exactly why our Microsoft 365 Assessment reviews mailbox rules, Conditional Access policy, and DMARC enforcement as standard scope, and our social engineering assessments test the human side of exactly this attack chain. For the DNS-level controls that block the spoofing variant specifically, see our piece on SPF, DKIM, and DMARC.