--- id: CP-017 slug: business-email-compromise-bec lang: en title: Business Email Compromise (BEC) description: How an attacker takes over a work mailbox or spoofs a known sender, and how to check a payment request before acting on it. canonical_url: https://startbrain.io/cyberpedia/en/articles/business-email-compromise-bec/ markdown_url: https://startbrain.io/cyberpedia/en/articles/business-email-compromise-bec.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Business Email Compromise (BEC)", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/business-email-compromise-bec/ (CC BY 4.0) wing: 1 theme: detect_phishing reflex: cr-007 schema: G1 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/business-email-compromise-bec/ fr: https://startbrain.io/cyberpedia/fr/articles/compromission-messagerie-professionnelle-bec/ de: https://startbrain.io/cyberpedia/de/articles/kompromittierung-geschaeftlicher-e-mails-bec/ es: https://startbrain.io/cyberpedia/es/articles/compromiso-correo-empresarial-bec/ sources: - "n": 1 title: "Phishing attacks: defending your organisation" publisher: NCSC (UK) url: https://www.ncsc.gov.uk/guidance/phishing published: "2018-02-05" accessed: "2026-11-03" - "n": 2 title: Phishing, Technique T1566 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1566/ accessed: "2026-11-03" - "n": 3 title: Internal Spearphishing, Technique T1534 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1534/ accessed: "2026-11-03" - "n": 4 title: Recognize and Report Phishing | CISA publisher: CISA url: https://www.cisa.gov/secure-our-world/recognize-and-report-phishing accessed: "2026-11-03" - "n": 5 title: "Email Collection: Email Forwarding Rule, Sub-technique T1114.003 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1114/003/ accessed: "2026-11-03" - "n": 6 title: "Phishing: Spearphishing Link, Sub-technique T1566.002 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1566/002/ accessed: "2026-11-03" - "n": 7 title: New sophisticated email-based attack from NOBELIUM | Microsoft Security Blog publisher: Microsoft url: https://www.microsoft.com/en-us/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ published: "2021-05-27" accessed: "2026-11-03" --- # Business Email Compromise (BEC) In business email compromise, an attacker uses a trusted address to deceive a colleague, a customer or a supplier. They have taken control of a real mailbox, or they build a message that imitates the sender. The employee receives a request that looks ordinary, such as a payment to make. Attackers exploit an organisation's working habits to obtain unauthorised payments [1]. The sources cited here do not all cover this fraud under its own name. They document the techniques that make it possible: sender spoofing, compromised accounts, hidden forwarding rules, poorly protected domains. This article keeps to what they say. ## In 30 seconds - Where it happens: in email, with a message that seems to come from a known contact, sometimes from the genuine account of a hijacked colleague [2][3]. - What the attacker wants: an unauthorised payment or passwords [1]. - The reflex: confirm any payment or change request through a second means of communication, using contact details you already have and not those in the message [1][4]. - If it is already done: report it right away, even after clicking. A quick report limits the damage [1]. ## Straight answers ### What is business email compromise? It is an email fraud in which the attacker plays the part of a trusted person. The sources describe two routes. Either the attacker spoofs the sender's identity, which MITRE calls "Email Spoofing" [2]. Or the attacker compromises a legitimate account and uses it to write to the victim's colleagues [3]. ### How do you recognise the message? CISA lists common signs: urgent or emotional language, a request for personal or financial information, incorrect addresses or links, such as amazan.com [4]. The same text states that poor spelling is no longer a reliable clue, because some emails now have perfect grammar [4]. ### Does a known address prove who sent the message? No. Sender spoofing can fool the human recipient and automated security tools [2]. An attacker can also join an existing discussion thread, which MITRE calls "thread hijacking" [2]. And when an internal account is genuinely compromised, the attacker exploits the trust placed in that account to deceive more people [3]. ### What if the request seems genuine? Do not click any link and do not call any number in the message. CISA recommends looking for another way to reach the company or the person, for example a number obtained from a verified website, or calling a contact whose number you already have [4]. The UK NCSC adds that important requests received by email should be checked through a second type of communication: text message, phone call, logging in to an account, confirmation by post or in person [1]. ### Should a mistaken click be reported? Yes. The NCSC asks that people who get caught out not be scolded, because those who fear punishment do not report their mistakes in time, or at all [1]. It also invites organisations to make sure users can report an email, including after clicking [1]. ## Inside the attacker's head The attacker has two starting points. The first is a stolen account. According to MITRE, a legitimate account can be compromised by controlling the user's device or by obtaining their credentials, and the attacker then uses it to trap other people in the same organisation [3]. To steal the credentials, the attacker can send a link to a site that imitates a login page [3]. Once inside the mailbox, the attacker can set up a forwarding rule there. It lets them monitor the victim's activity, steal information and learn more about the organisation [5]. It can also keep their access to the victim's emails after administrators reset the password [5]. The second starting point is spoofing, which requires no access. The attacker then does research using what is public. According to the NCSC, the information on your website and social networks is used to make targeted messages more convincing, notably to target an executive in a so-called "whaling" attack [1]. People who handle funds or administer IT interest the attacker more [1]. ## What you see on screen The message arrives from a familiar name and demands quick action. The signs described by CISA are urgency, a request for financial information and a slightly wrong address [4]. A neighbouring domain can be enough: MITRE notes that the Leviathan group sent link-based emails, often using a fraudulent "lookalike" domain and stolen branding [6]. The text is sometimes flawless. The NCSC cites a case where a fake invoice email that "needed urgent attention" was well written, with no spelling or grammar mistakes [1]. The displayed name does not tell the whole story. In the campaign described below, the email seemed to come from a usaid.gov address, while the real sending address belonged to the bulk-mailing service used, with a reply address (Reply-To) also in usaid.gov [7]. The following illustration is invented and neutralised. It shows the typical form of a suspicious request. ```text Illustration inventée, sans valeur réelle De : [nom d'un dirigeant] Objet : [paiement urgent] Corps : [demande de régler tout de suite une facture, de garder l'affaire confidentielle et de ne parler à personne] ``` ## Under the hood Three mechanisms recur in the sources. The first is credential theft by phishing, seen above. Against it, the NCSC recommends multifactor authentication: with a second factor, an attacker cannot access an account with the stolen password alone [1]. CISA gives the same advice to individuals [4]. The second is the forwarding rule. Rules can be created from a local application, a web interface or a command line, and can send messages to internal or external recipients without limit [5]. The attacker can also hide the rule by changing its properties through Microsoft's MAPI API, which makes it invisible in Outlook, OWA and most Exchange administration tools [5]. In Exchange, transport rules can even apply to all of an organisation's mail [5]. MITRE advises disabling external forwarding, auditing rules regularly and configuring out-of-band alerts on unusual sending, such as mass forwarding [5]. The third is control of the sending domain. MITRE recommends SPF to verify the sender's domain and DKIM for message integrity, and notes that a policy such as DMARC helps recipients filter in the same way [2]. The NCSC states that DMARC stops fraudsters from spoofing your domain, and that if the sender has a quarantine or reject DMARC policy, the recipient must apply it when validation fails [1]. MITRE also acknowledges that trapped internal email is hard to block with preventive controls, because it relies on the abuse of normal functions [3]. ## Case files ### 28 January 2021: the NOBELIUM campaign, first waves Microsoft has tracked a malicious email campaign run by NOBELIUM, the actor behind the SolarWinds attacks, since January 2021 [7]. It begins on 28 January 2021: the actor first sends only the follow-up part of the message, to spot the targets who click, without delivering a malicious payload [7]. This case aims at installing malware and not at a payment. It nonetheless shows the method: test, observe who reacts, adapt [7]. ### 25 May 2021: a trusted sender imitated at scale On 25 May 2021, NOBELIUM uses the legitimate bulk-mailing service Constant Contact to pose as a US development organisation [7]. It targets about 3,000 accounts in more than 150 organisations [7]. In one example, the email appears to come from USAID, with a genuine sending address ending in @in.constantcontact.com and a reply address in usaid.gov [7]. The link leads first to the legitimate service, then to the attacker's infrastructure, which delivers a malicious ISO file [7]. Automated systems blocked most of the emails and classed them as spam, but some of the first messages may have been delivered [7]. Microsoft recommends multifactor authentication to limit the effect of compromised credentials [7]. ## Sources 1. NCSC (UK), "Phishing attacks: defending your organisation", 5 February 2018. https://www.ncsc.gov.uk/guidance/phishing (accessed 3 November 2026) 2. MITRE ATT&CK, "Phishing, Technique T1566 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1566/ (accessed 3 November 2026) 3. MITRE ATT&CK, "Internal Spearphishing, Technique T1534 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1534/ (accessed 3 November 2026) 4. CISA, "Recognize and Report Phishing | CISA". https://www.cisa.gov/secure-our-world/recognize-and-report-phishing (accessed 3 November 2026) 5. MITRE ATT&CK, "Email Collection: Email Forwarding Rule, Sub-technique T1114.003 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1114/003/ (accessed 3 November 2026) 6. MITRE ATT&CK, "Phishing: Spearphishing Link, Sub-technique T1566.002 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1566/002/ (accessed 3 November 2026) 7. Microsoft, "New sophisticated email-based attack from NOBELIUM | Microsoft Security Blog", 27 May 2021. https://www.microsoft.com/en-us/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/business-email-compromise-bec/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.