Business Email Compromise
Protect the decisions behind your payments and business communications.
Business Email Compromise often succeeds without malware. Attackers exploit trust, urgency, authority and normal business processes to influence employees into making payments, changing account details or releasing sensitive information.
Why It Matters
BEC targets process, not infrastructure.
Because these attacks rarely involve a malicious attachment or link, they can bypass technical filtering entirely — the only defence is an employee who pauses to verify an unusual request.
Scenarios
- Supplier impersonation
- Invoice fraud
- Payment diversion
- Executive impersonation
- Payroll changes
- Banking detail changes
- Urgent payment requests
- Account takeover scenarios
Who Should Be Included
- Finance
- Accounts payable
- Procurement
- Executive offices
- HR and payroll
- Administration
- Customer service
Practical Controls
Combine awareness with processes such as:
- independent payment verification
- change-of-bank-detail verification
- escalation procedures
- dual authorisation
- suspicious-email reporting
See It In Action
BEC ScenarioIllustrative example
- ScenarioSupplier bank-detail change request
- AudienceAccounts Payable
- Verification StepIndependent callback required
- StatusActive
Security Outcomes
Verification becomes the default, not the exception.
Help employees recognise when an apparently legitimate business request requires additional verification.
Related Human Risk Capabilities
Strengthen BEC readiness.
Tell us about your organisation and current human risk programme. Our team will help scope the right next step.