Business Email Compromise (BEC)

CriticalIdentity & AccessN/A - Social Engineering

An attacker compromises or impersonates an executive, vendor, or employee mailbox to trick staff into wiring funds, changing payment details, or sending sensitive data.

Immediate Response

1Contact the bank immediately to recall or freeze fraudulent transfers.
2Reset the compromised account's password, revoke all sessions and tokens, and re-register MFA.
3Remove malicious inbox rules, forwarding, and OAuth app grants on the mailbox.
4Warn finance and affected vendors about the fraudulent requests.

All playbooks

1Search mail logs for other recipients of the attacker's messages and similar look-alike domains.
2Require out-of-band verification by phone for any payment detail change.
3Block external auto-forwarding at the mail gateway.
4Enforce DMARC reject on your domains and flag external senders in mail clients.

Long-term Prevention

1Require phishing-resistant MFA such as FIDO2 security keys or passkeys for all users.
2Implement dual approval for wire transfers and vendor master data changes.
3Monitor newly registered look-alike domains and take them down.
4Run regular BEC-focused awareness training for finance and executive assistants.

Attack vectors

Credential phishing that leads to mailbox takeover
Look-alike domains impersonating vendors or executives
Malicious inbox rules that hide replies and forward mail externally
Fraudulent invoice or bank detail change requests sent from a trusted thread

Indicators of compromise

New inbox rules that forward, delete, or move messages to RSS or archive folders
Sign-ins to mailboxes from unfamiliar countries or hosting providers
Urgent payment or bank change requests that bypass normal approval
Replies from domains that differ by a single character from a known vendor

Tooling

Microsoft Defender for Office 365Google Workspace Security CenterDMARC analyzersdnstwist