Business Email Compromise: how the attack really works — and how to stop it

Business Email Compromise (BEC) is the quietest expensive attack in security. There is no ransomware note, no encrypted file share and often no attachment or link at all — just a short, plausible email from someone the recipient already trusts, asking for a payment, a bank-detail change or a copy of a document. Because nothing in the message is technically malicious, the controls built to detect malicious content have very little to work with.

That is the whole point. BEC attacks target the decision, not the device. Understanding the sequence makes it much easier to see where a control can actually break the chain.

The five stages of a BEC attack

1. Reconnaissance

The attacker maps who pays whom. LinkedIn tells them who runs finance, who joined recently and who reports to whom. Your website tells them the suppliers, the accountant, and the tone your company writes in. Public procurement records, invoices leaked in previous breaches and even out-of-office replies fill in the rest.

2. Access or impersonation

There are two routes. The cheap route is impersonation: register a lookalike domain (liongroup.io versus liongr0up.io), or simply set a display name to "CEO — Mobile" from a free mailbox. The expensive, far more dangerous route is account takeover: phish or password-spray a real mailbox — typically a supplier's, not yours — and send from a genuine, fully authenticated address.

3. Observation

Inside a compromised mailbox the attacker is patient. They read the finance threads, learn the approval wording, note the payment cycle, and quietly create inbox rules that hide replies containing words like "invoice", "bank" or "fraud" so the real owner never sees the conversation.

4. The request

The email lands at the right moment in the payment cycle: an updated invoice with new bank details, a payroll diversion for a new employee, an urgent "confidential acquisition" wire, or a request for W-2/payroll data. It is short, uses the language of the business, and carries a soft time pressure rather than a shouted deadline.

5. Cash-out and cover

Funds are moved through mule accounts within hours. Recovery windows are measured in days at best, which is why detection and reporting speed matters more than post-incident forensics.

Why the secure email gateway misses it

• There is no payload to sandbox — no attachment, no URL, no macro.
• Reputation is clean: the sending domain is new-but-benign, or genuinely yours or your supplier's.
• Authentication passes when a real account is compromised, so SPF/DKIM/DMARC give a green light.
• Gateways inspect mail at the perimeter, so internal mailbox-to-mailbox fraud after a takeover is never seen.
• Signature and rule-based logic cannot judge whether "please update our bank details" is normal for this relationship.

Controls that actually break the chain

Effective BEC defence is layered, and each layer maps to one of the stages above.

1. Behavioural, inbox-level email security. A model of who normally emails whom, about what, from where, flags the first-time sender asking for a bank change and the internal message that does not match the relationship. This is the layer that catches supplier compromise, because it does not depend on authentication or reputation.
2. DMARC at p=reject on every domain you own — including parked and legacy domains. It does not stop lookalike domains, but it removes exact-domain spoofing from the attacker's toolkit entirely.
3. Lookalike-domain monitoring, so newly registered variants of your brand are found before they are used, not after.
4. Phishing-resistant MFA (FIDO2 or number-matching, not SMS) plus conditional access, to make the account-takeover route expensive.
5. Detection of malicious inbox rules and impossible-travel sign-ins — the two clearest fingerprints of a mailbox already under attacker control.
6. A payment-verification process that is boring and absolute: bank-detail changes are confirmed by callback to a number already on file, never to a number in the email, and never by a single approver.
7. One-click user reporting with automatic remediation across every mailbox, so one alert person protects the whole tenant in seconds.

A 30-day BEC hardening plan

1. Week 1: inventory every sending domain; publish SPF, DKIM and DMARC at p=none with reporting.
2. Week 1: enable phishing-resistant MFA for finance, executives and IT admins first.
3. Week 2: deploy behavioural, API-based email security that inspects internal traffic as well as inbound, and turn on user reporting.
4. Week 3: audit mailbox forwarding and inbox rules across the tenant; alert on new rules that hide mail.
5. Week 3: rewrite the payment-change procedure around callback verification and dual approval.
6. Week 4: run a targeted simulation on invoice-fraud and payroll-diversion scenarios, then train on the misses — not on everyone.
7. Ongoing: move DMARC from p=none to quarantine to reject as reports come clean, and monitor for lookalike domains.

How Lion Group helps

We deliver the behavioural email-security layer and the DMARC programme together, because BEC exploits the gap between them: one defends the mail you receive, the other defends the mail you send. Licensing, tenant provisioning and renewals run through our portal, so the security work does not turn into a procurement project.