What Is a Business Email Compromise Attack?

A business email compromise (BEC) attack is a targeted scam where an attacker impersonates someone an employee trusts — usually an executive, a known vendor, or a business partner — by email, in order to trick that employee into wiring money, redirecting a payment, or handing over sensitive data. Unlike most cyberattacks, BEC typically involves no malware, no exploited vulnerability, and no malicious link at all. It’s pure social engineering, which is exactly what makes it hard to stop with the security tooling most organizations already have in place.

How a BEC attack actually plays out

The mechanics are almost always the same shape, dressed up in different details:

• CEO fraud. An email arrives that appears to be from a senior executive, often with urgent, slightly unusual framing — “I’m in back-to-back meetings, need this wire sent today, can’t talk right now.” It targets someone with the authority to move money and leans on urgency and deference to seniority to short-circuit the normal skepticism they’d apply to an unfamiliar request.
• Vendor or invoice fraud. The attacker impersonates a supplier the company already pays regularly, sending an invoice or a “updated banking details” notice that redirects a legitimate, expected payment to an account the attacker controls. Because the underlying business relationship and payment are real, this variant is often the hardest to catch — nothing about the transaction looks unusual except the destination account.
• Payroll diversion. An email purporting to be from an employee asks HR or payroll to update their direct-deposit details, redirecting future paychecks to the attacker’s account.
• Account compromise as a stepping stone. In some cases the attacker has actually gained access to a real employee’s mailbox — through credential stuffing or a prior phishing attack — and sends the fraudulent request from the genuine account, inserting themselves into an ongoing, legitimate email thread rather than impersonating it from an external, similar-looking domain.

Why it works: no malware required

Most enterprise security investment is aimed at technical attacks — malware, exploited software vulnerabilities, man-in-the-middle interception. BEC sidesteps nearly all of it. There’s typically no attachment for antivirus to scan, no malicious link for a secure web gateway to block, and no exploit for an intrusion detection system to notice. The “payload” is a well-written sentence asking a real person to do something they’re otherwise authorized to do — send a wire transfer, update a bank record — which means the attack has to be caught by human judgment or by controls specifically built around verifying identity and intent, not by the defenses built to catch technical intrusions.

That’s also why BEC is disproportionately costly relative to how unsophisticated it is technically: there’s no malware to reverse-engineer and no vulnerability to patch, so the same basic playbook — a convincing pretext plus urgency — keeps working across targets and over time.

BEC vs adjacent attack types

	Business email compromise	Generic phishing	Spear phishing
Targeting	Highly specific — one person, one transaction	Broad, often mass-sent	Specific individual, but usually credential theft rather than a financial ask
Goal	Direct financial transfer or data exfiltration	Usually credential harvesting	Usually credential harvesting or malware delivery
Payload	None — just a written request	Malicious link or attachment	Malicious link or attachment
Research required	High — real names, real vendors, real context	Low	Moderate to high

The lines blur in practice — a spear-phishing email that steals an executive’s credentials is often step one of a BEC attack that follows days or weeks later, once the attacker has read enough of the mailbox to understand who signs off on payments and how those requests are normally worded.

Technical defenses that help

Even though BEC is a social-engineering attack rather than a technical one, several technical controls close off the easiest versions of it:

• SPF, DKIM, and DMARC make it much harder for an attacker to send email that appears to originate from your own domain, closing off the crudest version of the attack — a message that’s actually spoofing yourcompany.com rather than using a look-alike domain.
• Multi-factor authentication on email accounts blocks the account-compromise variant, where the attacker needs a valid password alone to get into a real mailbox; even a leaked or credential-stuffed password isn’t enough on its own once a second factor is required.
• Passkeys, where supported, go further by removing the shared secret entirely, which also closes off the phishing step that often precedes account compromise in the first place.
• Zero trust principles applied to financial workflows — requiring a second, independent channel of verification for any payment or banking-detail change, regardless of how the request arrived or how authoritative it looks — remove the single point of failure that BEC is designed to exploit.

Defenses for the humans in the loop

Because the attack targets judgment rather than infrastructure, the most effective mitigation is procedural: any request to move money or change payment details should require verification through a channel independent of the one the request arrived on. A call to a phone number already on file — not one provided in the email — confirming a wire transfer or a change of banking details defeats BEC regardless of how convincing the email itself is, because it doesn’t matter how well-crafted the pretext is if the verification step never depends on trusting the email at all.

Training that specifically covers the urgency-plus-authority pattern common to CEO fraud tends to outperform generic “watch out for phishing” advice, because BEC emails are often free of the more obvious phishing tells — misspellings, obviously wrong sender domains, suspicious links — that most security awareness training focuses on.

The takeaway

Business email compromise succeeds by exploiting trust and urgency rather than a technical vulnerability, which is why it slips past defenses built for malware and malicious links. The email itself is the entire attack — a convincing request from someone the target trusts, asking for something the target is otherwise authorized to do. Closing off the easy variants takes domain-authentication controls like SPF, DKIM, and DMARC plus strong account authentication; closing off the rest takes an out-of-band verification step for any request to move money, one that never depends on trusting the channel the request arrived through in the first place.