The company accountant receives an email from the CEO: “I’m in a meeting and can’t take calls. Transfer this amount to this account today, and don’t mention it to anyone for now.” Or an email arrives from a long-standing supplier saying their bank account has changed and the next invoice should be paid to the new account. Both are common examples of BEC (Business Email Compromise) fraud. There is no infected attachment and no suspicious link in this attack, just a believable message and a conscientious employee who wants to get the job done quickly. Once money is transferred, getting it back is usually very difficult.
How does the attacker impersonate someone else?
- Display name spoofing: The sender name is exactly the CEO’s name, but the real address is a free or unknown email account. On phones, where usually only the name is shown, this trick works easily.
- Lookalike domain: A domain that resembles your company’s or a supplier’s domain, with one letter swapped or added.
- Direct domain spoofing: If the domain’s SPF, DKIM and DMARC records aren’t set up correctly, sending email from the real address itself may be possible.
- A real, compromised mailbox: The most dangerous case. The attacker has obtained the password of one of your employees’ or a supplier’s mailbox, reads the correspondence, and changes the bank details right in the middle of a real conversation. They often also create a mailbox rule that hides replies or forwards them outside.
Warning signs
- Unusual urgency and pressure to act before the end of the day
- A request to keep the matter confidential and bypass the normal process
- A change of bank account or payment details by email
- Avoiding a phone call or providing a new phone number
- A slight difference in the sender’s address, or a reply address (Reply-To) that differs from the sender’s address
Prevention: process first, then technology
The most important barrier against BEC is a simple company rule, not software:
- Confirm every change to payment details with a phone call. Call the number already on file for the supplier, not a number given in the same email.
- Require two approvers for payments above a set threshold.
- Managers should state clearly that they will never ask by email to bypass the payment process, so employees don’t feel uneasy about calling to check.
- Confirm unusual requests from anyone, at any level, through a second channel such as a phone call or in person.
The golden rule for the finance team: email alone is never enough to change a bank account or make an urgent payment, even if it comes from a real, familiar address.
Supporting technical measures
- Two-factor authentication for webmail and email access, so a leaked password alone isn’t enough.
- A “message from outside the organization” tag or warning on incoming email, especially when the sender’s name matches a manager’s name.
- Full SPF, DKIM and DMARC configuration to make direct spoofing of the company domain harder.
- Monitoring automatic forwarding rules to external addresses and periodically reviewing the rules on finance team mailboxes.
- Short, periodic training for finance staff and executive assistants using real examples.
If it happens
- Call your bank immediately; speed is critical when tracing a funds transfer.
- Don’t delete the emails; keep them with their full headers.
- If a mailbox has been compromised, change its password, end active sessions and remove suspicious rules.
- Notify the supplier or customer involved; their mailbox may have been compromised.
- Report the incident to the police cybercrime unit.
Checklist
- Phone confirmation of every payment detail change using the number on file
- Two approvers for payments above the threshold
- Two-factor authentication for mailboxes
- External email tagging and SPF, DKIM and DMARC records
- Monitoring of forwarding rules and finance team mailboxes
- Periodic training for finance staff
ITPlus724 engineers can review your company’s business email security settings and implement two-factor authentication, external email tagging and forwarding rule monitoring.