Ransomware gets the headlines because it is loud. It locks screens, posts on leak sites, and shuts down hospitals. Business email compromise, usually shortened to BEC, is the opposite. It is quiet, it leaves almost no technical footprint, and it often succeeds on the first try. There is no payload to detect, no malicious attachment for a scanner to flag, no unusual process on the endpoint. There is just a message, and the message asks a person to do something they are authorized to do, worded so it feels routine.
That is what makes it hard. Most security spending assumes the threat is code. BEC is a con, and the target is a human decision, not a machine.
The Five Common Variants
The FBI groups BEC into a handful of recurring shapes. They share a structure but differ in who is impersonated and what the ask is.
- CEO fraud. The attacker poses as an executive and directs a finance employee to make an urgent wire transfer, often framed as a confidential acquisition that cannot be discussed with colleagues. The confidentiality framing is deliberate: it discourages the one action that would break the con, which is asking someone else.
- Invoice or supplier fraud. The attacker impersonates a known vendor and sends updated bank details for an expected payment. The invoice is real, the amount is expected, only the destination account has changed. This is the highest-yield variant because it rides an already-legitimate transaction.
- Account compromise. The attacker has actual control of a real employee's mailbox, obtained through phishing or credential theft, and sends requests from the genuine account. Nothing is spoofed because nothing needs to be.
- Attorney impersonation. The attacker poses as a lawyer handling a time-sensitive, sensitive matter, using authority and urgency to pressure a quick, quiet payment.
- Data theft. Instead of money, the ask is information: payroll records, tax forms, or employee data, usually aimed at HR. The stolen data feeds the next round of fraud.
Why the Supplier Variant Is So Effective
Invoice fraud deserves its own look because it defeats the instinct people rely on. Employees are trained to distrust the unexpected. A supplier-fraud email is the expected. Your company genuinely owes this vendor, the invoice number matches, the amount is right, and the only anomaly is a line that says the vendor changed banks. Vendors do change banks. The request is not implausible, it is mundane, and mundane requests do not trigger the alarm that a strange one would.
The attacker usually earns this precision through reconnaissance. Sometimes they sit inside a compromised mailbox for weeks, reading the thread between buyer and supplier, learning the tone, the names, the payment cadence, and they strike at exactly the right point in a real conversation. This is why account compromise and invoice fraud so often appear together.
Standard email carries no cryptographic proof of who wrote a message. The display name is a free-text field. The From address can be forged or merely look similar. When a request arrives, the recipient is authenticating the sender with judgment and familiarity, not with any technical guarantee.
How the Impersonation Is Done
There are three technical tiers, and it helps to know which one you are looking at.
Display-name spoofing is the crudest. The attacker sets the sender name to "Jordan Chen, CFO" while the actual address is some throwaway account. On a phone, many mail clients show only the name, so the address never appears. This costs nothing and still works.
Lookalike domains are the middle tier. The attacker registers a domain that reads like yours at a glance: a swapped letter, an added word, a different top-level domain. Replies go to the attacker, and the human eye skims right over the difference. Some of these use homograph tricks with characters that render almost identically to Latin letters.
Genuine spoofing and account takeover are the top tier. True From-address spoofing is what email authentication was designed to stop, and where SPF, DKIM, and DMARC are correctly deployed, forging your exact domain is much harder than it used to be. That is real progress. It is also why attackers have shifted toward lookalike domains and toward taking over real accounts, both of which sail past domain authentication because, technically, the mail is legitimate.
What Email Authentication Does and Does Not Cover
SPF, DKIM, and DMARC are worth deploying and every organization should. But be precise about the boundary. They verify that a message claiming to be from your domain was actually authorized to send as your domain. They do nothing about a message from your-company-invoices.com, which is a different domain the attacker legitimately controls, and nothing about a message from a real employee's hijacked account, which passes every check because it is authentic.
| Attack | Blocked by SPF/DKIM/DMARC? |
|---|---|
| Forging your exact domain | Yes, when correctly enforced |
| Display-name spoofing | No, the name is free text |
| Lookalike domain | No, it is a real domain the attacker owns |
| Compromised real account | No, the mail is genuine |
The lesson is not that authentication is pointless. It closes the easiest attack and forces the adversary onto harder, more detectable ground. The lesson is that it is a floor, not a solution, and a control that stops only one of four variants cannot be the whole defense.
The Defenses That Actually Work
Because BEC targets a decision, the durable defenses are process controls, not filters. The single most effective one is out-of-band verification: any change to payment details, and any unusual transfer request, is confirmed through a separate channel using a number you already had, never the number or reply address in the email itself. A thirty-second phone call to a known contact breaks nearly the entire class.
Beyond that, a short list carries most of the weight:
- Dual authorization for wire transfers above a threshold, so no single person can move funds alone.
- A hard rule that banking-detail changes require callback verification, written into the payment process rather than left to judgment.
- Phishing-resistant multi-factor authentication on email accounts, ideally hardware-backed, to blunt the account-takeover variant. See our comparison of hardware keys versus authenticator apps.
- Removing urgency and secrecy as override buttons. Train people that "urgent and confidential, do not tell anyone" is the signature of the attack, not a reason to skip the check.
If money has already moved, speed matters more than anything. Reporting a fraudulent wire to the bank and to law enforcement within the first day or two gives the best chance of a recall or freeze. After that window the funds are usually layered through mule accounts and gone.
Where Haven Fits
BEC exploits a gap Haven takes seriously: ordinary email carries no proof of who is really speaking. Encryption alone does not close that gap, which is why the honest framing is about verification, not just secrecy. When messages are cryptographically signed by keys tied to an identity you have confirmed, "is this really from them" stops being a judgment call and becomes something you can check. Haven signs and encrypts messages between users so provenance is a property of the message, not a guess based on a display name. It will not repair the wider email world overnight, and no tool substitutes for a callback before you move money. But the direction is the right one: make who-sent-this a fact the recipient can verify rather than a con the sender can exploit.