Business Email Compromise (BEC)
How an attacker takes over a work mailbox or spoofs a known sender, and how to check a payment request before acting on it.
In 30 seconds
- Where it happens
- In email, with a message that seems to come from a known contact, sometimes from the genuine account of a hijacked colleague23.
- What the attacker wants
- An unauthorised payment or passwords1.
- The reflex
- Confirm any payment or change request through a second means of communication, using contact details you already have and not those in the message14.
- If it is already done
- Report it right away, even after clicking. A quick report limits the damage1.
What it is
In business email compromise, an attacker uses a trusted address to deceive a colleague, a customer or a supplier. They have taken control of a real mailbox, or they build a message that imitates the sender. The employee receives a request that looks ordinary, such as a payment to make. Attackers exploit an organisation's working habits to obtain unauthorised payments1.
The sources cited here do not all cover this fraud under its own name. They document the techniques that make it possible: sender spoofing, compromised accounts, hidden forwarding rules, poorly protected domains. This article keeps to what they say.
Straight answers
What is business email compromise?
It is an email fraud in which the attacker plays the part of a trusted person. The sources describe two routes. Either the attacker spoofs the sender's identity, which MITRE calls "Email Spoofing"2. Or the attacker compromises a legitimate account and uses it to write to the victim's colleagues3.
How do you recognise the message?
CISA lists common signs: urgent or emotional language, a request for personal or financial information, incorrect addresses or links, such as amazan.com4. The same text states that poor spelling is no longer a reliable clue, because some emails now have perfect grammar4.
Does a known address prove who sent the message?
No. Sender spoofing can fool the human recipient and automated security tools2. An attacker can also join an existing discussion thread, which MITRE calls "thread hijacking"2. And when an internal account is genuinely compromised, the attacker exploits the trust placed in that account to deceive more people3.
What if the request seems genuine?
Do not click any link and do not call any number in the message. CISA recommends looking for another way to reach the company or the person, for example a number obtained from a verified website, or calling a contact whose number you already have4. The UK NCSC adds that important requests received by email should be checked through a second type of communication: text message, phone call, logging in to an account, confirmation by post or in person1.
1Inside the attacker's head1 min
The attacker has two starting points. The first is a stolen account. According to MITRE, a legitimate account can be compromised by controlling the user's device or by obtaining their credentials, and the attacker then uses it to trap other people in the same organisation3. To steal the credentials, the attacker can send a link to a site that imitates a login page3.
Once inside the mailbox, the attacker can set up a forwarding rule there. It lets them monitor the victim's activity, steal information and learn more about the organisation5. It can also keep their access to the victim's emails after administrators reset the password5.
The second starting point is spoofing, which requires no access. The attacker then does research using what is public. According to the NCSC, the information on your website and social networks is used to make targeted messages more convincing, notably to target an executive in a so-called "whaling" attack1. People who handle funds or administer IT interest the attacker more1.
2What you see on screen1 min
The message arrives from a familiar name and demands quick action. The signs described by CISA are urgency, a request for financial information and a slightly wrong address4. A neighbouring domain can be enough: MITRE notes that the Leviathan group sent link-based emails, often using a fraudulent "lookalike" domain and stolen branding6.
The text is sometimes flawless. The NCSC cites a case where a fake invoice email that "needed urgent attention" was well written, with no spelling or grammar mistakes1.
The displayed name does not tell the whole story. In the campaign described below, the email seemed to come from a usaid.gov address, while the real sending address belonged to the bulk-mailing service used, with a reply address (Reply-To) also in usaid.gov7.
The following illustration is invented and neutralised. It shows the typical form of a suspicious request.
Illustration inventée, sans valeur réelle
De : [nom d'un dirigeant] <[email protected]>
Objet : [paiement urgent]
Corps : [demande de régler tout de suite une facture, de garder
l'affaire confidentielle et de ne parler à personne]3Under the hoodIT teams2 min
Three mechanisms recur in the sources.
The first is credential theft by phishing, seen above. Against it, the NCSC recommends multifactor authentication: with a second factor, an attacker cannot access an account with the stolen password alone1. CISA gives the same advice to individuals4.
The second is the forwarding rule. Rules can be created from a local application, a web interface or a command line, and can send messages to internal or external recipients without limit5. The attacker can also hide the rule by changing its properties through Microsoft's MAPI API, which makes it invisible in Outlook, OWA and most Exchange administration tools5. In Exchange, transport rules can even apply to all of an organisation's mail5. MITRE advises disabling external forwarding, auditing rules regularly and configuring out-of-band alerts on unusual sending, such as mass forwarding5.
The third is control of the sending domain. MITRE recommends SPF to verify the sender's domain and DKIM for message integrity, and notes that a policy such as DMARC helps recipients filter in the same way2. The NCSC states that DMARC stops fraudsters from spoofing your domain, and that if the sender has a quarantine or reject DMARC policy, the recipient must apply it when validation fails1. MITRE also acknowledges that trapped internal email is hard to block with preventive controls, because it relies on the abuse of normal functions3.
4Case filesReal cases1 min
28 January 2021: the NOBELIUM campaign, first waves
Microsoft has tracked a malicious email campaign run by NOBELIUM, the actor behind the SolarWinds attacks, since January 20217. It begins on 28 January 2021: the actor first sends only the follow-up part of the message, to spot the targets who click, without delivering a malicious payload7. This case aims at installing malware and not at a payment. It nonetheless shows the method: test, observe who reacts, adapt7.
25 May 2021: a trusted sender imitated at scale
On 25 May 2021, NOBELIUM uses the legitimate bulk-mailing service Constant Contact to pose as a US development organisation7. It targets about 3,000 accounts in more than 150 organisations7. In one example, the email appears to come from USAID, with a genuine sending address ending in @in.constantcontact.com and a reply address in usaid.gov7. The link leads first to the legitimate service, then to the attacker's infrastructure, which delivers a malicious ISO file7.
Automated systems blocked most of the emails and classed them as spam, but some of the first messages may have been delivered7. Microsoft recommends multifactor authentication to limit the effect of compromised credentials7.
Fact sheet
- Identifier
- CP-017
- Wing
- 1. Attacks and techniques
- Brain skill
- Detecting Phishing (detect_phishing)
- Brain reflex
- cr-007
- Diagram
- G1 · Attack vs Defense Chain
- Languages
- de, en, fr
- Sources
- 7 sources checked on 3 November 2026
Sources7 sources
- NCSC (UK), “Phishing attacks: defending your organisation”, 5 February 2018. https://www.ncsc.gov.uk/guidance/phishing (accessed 3 November 2026)
- MITRE ATT&CK, “Phishing, Technique T1566 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1566/ (accessed 3 November 2026)
- MITRE ATT&CK, “Internal Spearphishing, Technique T1534 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1534/ (accessed 3 November 2026)
- CISA, “Recognize and Report Phishing | CISA”. https://www.cisa.gov/secure-our-world/recognize-and-report-phishing (accessed 3 November 2026)
- MITRE ATT&CK, “Email Collection: Email Forwarding Rule, Sub-technique T1114.003 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1114/003/ (accessed 3 November 2026)
- MITRE ATT&CK, “Phishing: Spearphishing Link, Sub-technique T1566.002 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1566/002/ (accessed 3 November 2026)
- Microsoft, “New sophisticated email-based attack from NOBELIUM | Microsoft Security Blog”, 27 May 2021. https://www.microsoft.com/en-us/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ (accessed 3 November 2026)
Cite this article
Brain, “Business Email Compromise (BEC)”, Cyberpedia, 2026. https:/
BibTeX
@misc{brain_cp017_en_2026,
author = {Brain},
title = {Business Email Compromise (BEC)},
year = {2026},
howpublished = {Cyberpedia},
url = {https://startbrain.io/cyberpedia/en/articles/business-email-compromise-bec/},
note = {CC BY 4.0}
}