Business Email Compromise

Layer 8: People High risk

How it works

Business email compromise, or BEC, relies on trust rather than malware. In many cases attackers first steal the password to a real mailbox, often through phishing. They then read quietly for days or weeks, learning who pays whom, how invoices are approved and what conversations are underway. They frequently create hidden inbox rules so replies and warnings are moved out of sight.

At the right moment, the attacker sends a message from the genuine account, or from a lookalike address, asking for a change in banking details, an urgent wire transfer or a copy of payroll or tax records. Because the request appears in an existing conversation from a known person, it rarely looks suspicious. Funds are moved quickly through other accounts, making recovery difficult once the transfer is noticed.

Warning signs

• Inbox rules you did not create that forward, delete or move messages
• Contacts mentioning emails you never sent
• Sign-in alerts from unfamiliar locations or devices
• Requests to change banking details, especially by email only
• Pressure for secrecy or speed on a financial request

How to defend against it

• Enforce multi-factor authentication on every mailbox
• Alert on new forwarding rules and suspicious sign-ins
• Verify payment changes by phone using a number already on file
• Require two-person approval for new payees and large transfers
• Disable legacy email protocols that bypass MFA
• Train finance and executive staff on BEC tactics

If it happens to you

1. Contact your bank immediately to attempt a recall of any transfer
2. Reset the account password, revoke sessions and remove malicious rules
3. Notify affected clients or vendors through a trusted channel
4. Report to police and the Canadian Anti-Fraud Centre