Defending Against Business Email Compromise (BEC) and Wire Fraud

Business email compromise (BEC) uses impersonation or access to a real mailbox to make a fraudulent request seem routine. Attackers may pose as an executive, supplier, customer, or colleague and ask for a payment, changed bank details, gift cards, sensitive information, or an urgent action.

Scope: This guide covers common BEC and wire-fraud patterns across industries. It is general security guidance, not a report about a specific Defenssive customer or incident.

How BEC turns trust into financial risk

Fraudsters may register a lookalike domain, compromise a mailbox, or take over an existing email conversation. They often rely on urgency, secrecy, or a last-minute change to bypass normal approval steps. The details vary, and email may be only one part of a broader fraud attempt.

A simplified risk path

A convincing email can pressure people to skip a normal check.

01Impersonation or accessA lookalike sender or compromised account appears familiar.

02Urgent changeA message requests a payment, new bank details, or sensitive information.

03Verification is bypassedA rushed employee relies on the email instead of a separate trusted channel.

04Loss or exposureFunds or business information may be sent to the wrong party.

Illustrative sequence only; real incidents vary and may not begin with email.

Practical safeguards for every organization

1Verify payment changes out of band. Call a known number already on file. Do not use contact details supplied in the change request.

2Use dual approval for high-impact payments. Require a second authorized person to review new beneficiaries and changes to account details.

3Protect Microsoft 365 sign-ins. Require MFA, prefer phishing-resistant methods where practical, and review Conditional Access and administrator protections.

4Watch for mailbox changes. Review unexpected forwarding rules, delegates, inbox rules, app consent, and suspicious sign-ins.

5Make reporting easy. Give staff a clear way to report unusual requests and unexpected authentication prompts without fear of blame.

6Protect your domain. Configure SPF, DKIM, and DMARC deliberately and monitor lookalike-domain abuse.

No single email filter or identity control prevents every BEC attempt. Layer technical protections with verification procedures that employees can follow under pressure.

If a payment request seems suspicious

Pause the payment or account change while you verify it independently.
Contact the requester using a trusted number or contact method already in your records.
Notify finance, IT, and security contacts; preserve the email, headers, and relevant sign-in activity.
If a mailbox may be compromised, follow your incident process to secure the account and review forwarding, delegates, app access, and active sessions.
If money was sent, contact your financial institution promptly and report the incident to the appropriate authorities.

Questions to take back to your team

Which payment or banking changes require independent callback verification?
Who can approve a new payee or change vendor payment details?
Can employees quickly report suspicious email and unexpected MFA prompts?
Can your IT team review sign-ins, mailbox rules, forwarding, and app access?

Sources and further reading

These public resources describe common BEC patterns and recommended safeguards:

FBI, Business Email Compromise guidance — common attack patterns and protective steps.
CISA, Avoiding Social Engineering and Phishing Attacks — ways to recognize and respond to suspicious messages.

Defending Against Business Email Compromise (BEC) and Wire Fraud

How BEC turns trust into financial risk

A convincing email can pressure people to skip a normal check.

Practical safeguards for every organization

If a payment request seems suspicious

Questions to take back to your team

Sources and further reading

Strengthen the email and identity controls behind your business.