Business email compromise

Business email compromise (BEC) is fraud that runs on trust rather than malware. An attacker uses a credible email identity to persuade someone with authority to move money or release data: a supplier updating their bank details, a chief executive requesting an urgent transfer, a payroll change submitted the week before a run. There is often no attachment, no link, and nothing for a scanner to detect, because the only malicious component is the instruction.

The identity comes from one of three places, and the distinction decides which controls help. It may be an outright forgery of your exact domain in the From: header, which DMARC at p=reject does stop. It may be a lookalike domain registered by the attacker, which publishes its own records, authenticates flawlessly for itself, and which email authentication has no opinion about. Or it may be a genuinely compromised mailbox on your real domain, in which case the message is not a forgery at all: it is signed by your own keys and aligns perfectly, because it really was sent from that account.

That third case is why BEC losses stay high at organizations with fully enforced email authentication. The controls that address it are different in kind: phishing-resistant multi-factor authentication to make mailbox takeover harder, out-of-band verification of payment changes so no single email can move money, and finance processes that treat an urgent request as a reason for more scrutiny rather than less. Related: phishing and email spoofing.