How organizations combat business email compromise

Invoice and payment scams. Criminals impersonate a vendor or customer and request payment for an outstanding invoice or ask that future payments be redirected to a new account. The email may contain a malicious link or attachment that directs the recipient to a phishing site or prompts them to download malware.

Urgent request from a supervisor. An employee receives an email that appears to be from their supervisor or a senior executive, urging them to quickly send a gift or payment. In some cases, the scammer may first ask to switch to text messaging or video conferencing before making the request. They may also use AI-generated text or video to make the interaction seem more convincing.

Whaling. A targeted campaign that focuses on high‑level executives to achieve financial gain, steal sensitive data or damage the reputation of the individual or organization. These attacks often begin with business email compromise (BEC) tactics.

Data requests/theft. Scammers may request personally identifiable information (PII) from employees or customers to use in subsequent financial scams.

Commodities requests/theft. Scammers pose as purchasing departments for established vendors, make large purchases on credit and arrange for shipment of goods that are never paid for.

Whatever the method, criminals count on recipients being fooled or missing signs that something about the email is unusual. This is the point where the social engineering — or coercion — begins. 

As with every type of cybercrime, there is no absolute defense against BEC. A combination of tools, enforced policies and employee engagement can minimize the risks. Specific defenses can include:

Investing in strong email gateway controls. This includes advanced filtering, authentication, and encryption for inbound mail to help detect spoofed domains and anomalous communications. Organizations should also implement domain-based message authentication, reporting, and conformance (DMARC) to protect against spoofing and consider brand indicators for message identification (BIMI) to help recipients recognize authentic emails in supported environments. Note: While these controls help reduce spoofing, they do not prevent direct account takeover.

Deploying and maintaining strong identity access and account privilege management. Identity and access management (IAM) and privileged access management (PAM) are methods that make it more difficult for unauthorized users to exploit stolen credentials to initiate BEC attempts. Used in conjunction with multifactor authentication (MFA) or biometrics, these protections can be effective assuming organizations don’t set and forget them. Review and enforcement of these policies is critical.

Redundant payment approvals. Anomalous requests or changes to payment information should require extra layers of review and approval.

Employee training and awareness. Any successful BEC attempt depends on eluding controls or deceiving an employee. Organizations should regularly train all employees (especially employees responsible for accounts payable and receivables) and make BEC and cyberthreat awareness part of company culture.

BEC is likely to persist in an environment that depends on speed, convenience and friction-free transactions between vendors and customers and partner organizations. A strong defense depends on encouraging employees to slow down when something about an email feels unusual. “Trust but verify” remains a critical principle for maintaining strong cybersecurity practices and sound business outcomes.