What is business email compromise (BEC)?

The details

The most reliable defense is a process, not a tool: any new or changed payment details must be confirmed by a phone call to a number already on file, never to one supplied in the email. Requiring two people to approve large or unusual payments adds another check.

Multi-factor authentication on email accounts makes takeover harder, and DMARC on your domain makes direct spoofing of your address harder.

What to do

• Verify every bank-detail change by calling a known number.
• Require dual approval for large or first-time payments.
• Turn on MFA for all email accounts.
• Publish SPF, DKIM and DMARC for your domain.

Useful next reads and tools

• Phishing Email Header Analyzer · tool

Terms explained

Business email compromise

Business email compromise (BEC) is fraud in which a criminal impersonates or takes over a trusted email account to trick an organization into sending money or sensitive data.

DMARC

DMARC is a DNS policy that tells receiving mail servers what to do with email that fails SPF and DKIM alignment for your domain, and where to send reports about it.

Malware

Malware is any software designed to harm, spy on or gain unauthorized control of a device, network or account.

Multi-factor authentication

Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.

Sources

• FBI Internet Crime Complaint Center (IC3)
• FTC: Cybersecurity for Small Business
• CISA: Recognize and Report Phishing