1. The Email That Looked Completely Normal

A finance employee receives an email from a familiar supplier. The message explains that the supplier has updated its bank account and asks that the new details be used for the next invoice payment.

The email contains the supplier's usual signature, references a genuine business relationship, and arrives during a normal payment cycle.

Nothing appears unusual.

The employee updates the payment details and transfers the money. Days later, the supplier contacts the company to ask why the invoice remains unpaid.

The investigation reveals that the payment went to an account controlled by a criminal.

This is a classic Business Email Compromise scenario. The attacker does not necessarily need to exploit a software vulnerability or deploy malware. Instead, the attack exploits trust in business communication and weaknesses in payment verification procedures.

The fraudulent email may have originated from a lookalike domain, a compromised supplier account, or another impersonation method. Determining which method was used is a critical part of the investigation.

2. What Is Business Email Compromise?

Business Email Compromise is a form of targeted fraud in which an attacker manipulates business email communications to obtain money, sensitive information, or other valuable resources.

BEC campaigns commonly target employees involved in payments, payroll, procurement, executive support, and supplier management.

The attacker may impersonate a trusted person or abuse an account that has already been compromised.

Common BEC scenarios include:

• CEO fraud: An attacker impersonates a senior executive and requests an urgent payment.

• Invoice fraud: A criminal alters or replaces supplier payment instructions.

• Account compromise: An attacker gains access to a legitimate business mailbox and uses it to send fraudulent messages.

• Payroll diversion: An employee is deceived into changing another employee's salary payment details.

• Lawyer or executive impersonation: A message claims that a confidential transaction requires an immediate transfer.

• Sensitive information theft: An attacker requests employee records, financial documents, or other confidential business information.

BEC is not a single malware family or exploit. It is an attack category that can involve social engineering, identity compromise, email infrastructure abuse, and financial fraud.

3. Anatomy of a BEC Attack

A BEC incident can unfold through several stages. The sequence varies depending on whether the attacker uses a lookalike domain, compromises an existing mailbox, or relies on another impersonation technique.

Stage 1: Researching the target

Attackers may collect information from company websites, professional networking profiles, public documents, and previously exposed data.

They may identify executives, finance employees, suppliers, reporting relationships, and normal payment procedures.

This information helps them create requests that fit the organisation's daily operations.

SOC focus: Review the target's publicly exposed information where relevant, but prioritise evidence of suspicious emails, account activity, and payment changes.

Stage 2: Establishing a believable identity

The attacker may register a domain resembling a legitimate supplier's domain, spoof a sender where email controls permit, or compromise a real business account.

A lookalike domain may differ from the legitimate address by only a small spelling change.

A compromised account can be especially convincing because messages may arrive from a genuine mailbox and appear within an existing conversation.

SOC focus: Compare the sender and reply-to addresses, inspect message headers, validate the domain, and investigate whether the genuine account may have been compromised.

Stage 3: Creating urgency or confidentiality

The attacker sends a message requesting a payment, confidential document, or change to financial details.

The message may claim that a transaction is urgent, that an executive is travelling, or that the matter must remain confidential.

These tactics discourage employees from following normal verification procedures.

SOC focus: Examine whether the request bypasses standard approvals or differs from the established business process.

Stage 4: Manipulating the business process

The victim may approve a transfer, change supplier details, disclose sensitive information, or perform another action that benefits the attacker.

The key failure may be procedural rather than technical. Even a well-protected email account can receive a fraudulent message.

SOC focus: Coordinate with finance, procurement, or payroll teams to establish whether the requested action was performed and whether it can be reversed.

Stage 5: Concealing or extending the fraud

In some account-compromise incidents, attackers use mailbox rules, forwarding settings, or continued access to monitor conversations and interfere with follow-up communications.

They may try to delay discovery by ensuring that the victim does not see replies from the genuine supplier.

These behaviours are possible investigation leads, not features present in every BEC campaign.

SOC focus: Review mailbox configuration changes, suspicious forwarding, deleted messages, unusual logons, and activity following the fraudulent request.

Stage 6: Financial loss or data exposure

The incident may result in money being transferred to a criminal-controlled account or confidential information being disclosed.

The organisation must establish the actual impact rather than assuming that every fraudulent email resulted in a successful transaction.

SOC focus: Determine whether funds moved, whether sensitive data was accessed, and whether additional employees or business partners were targeted.

4. Real-World BEC: How the FBI Describes the Threat

The US Federal Bureau of Investigation (FBI) has repeatedly warned that BEC is a significant form of financial cybercrime. Its public guidance describes schemes involving executive impersonation, fraudulent invoices, compromised email accounts, and requests to change payment instructions.

A common pattern is supplier-payment diversion. An attacker impersonates a supplier or compromises a business email account and sends altered payment details to an employee responsible for invoices. If the employee accepts the change without independently verifying it, the payment may be sent to a criminal-controlled account.

The FBI's Internet Crime Complaint Center (IC3) has documented substantial reported losses associated with BEC over multiple years. These figures reflect reported complaints and should not be interpreted as a complete measure of all incidents, since not every victim reports a crime.

The lesson is that BEC does not depend on one technical weakness. It exploits the relationship between business communication and financial authority.

For organisations, independent verification of payment changes is therefore as important as email filtering and account security.

5. Why BEC Can Bypass Traditional Security Controls

Many security tools are designed to detect malicious attachments, suspicious URLs, malware, or known phishing infrastructure.

BEC messages may contain none of these.

A fraudulent email can be plain text, contain no attachment, and request a legitimate business action. When an attacker uses a compromised account, the message may also originate from a trusted mailbox.

Several factors make BEC challenging:

No malware required: A fraudulent request can succeed without executing code on the victim's device.

Trusted relationships: Employees naturally expect communications from colleagues and established suppliers.

Legitimate accounts: Compromised mailboxes can be used to send messages from real identities.

Business-process weaknesses: Email instructions may be accepted without independent confirmation.

Delayed detection: The fraud may not become apparent until a supplier complains or a payment is reconciled.

This is why BEC detection must combine technical monitoring with business-process controls.

6. How SOC Analysts Investigate a BEC Incident

A structured investigation should establish the source of the message, whether an account was compromised, which users were affected, and whether the attack resulted in financial or data loss.

Step 1: Preserve the original email

Collect the original message in a format that preserves its headers and relevant metadata.

Record the sender, recipient, reply-to address, subject, timestamps, message ID, links, and attachments.

Avoid relying exclusively on screenshots or forwarded copies because they may omit important header information.

Step 2: Analyse email authentication and routing

Review SPF, DKIM, and DMARC results alongside the message's routing information.

These controls can help identify some forms of spoofing, but a message that passes authentication is not necessarily legitimate. An attacker may be using a lookalike domain or a compromised account.

Compare the sender domain with known supplier records and previously received correspondence.

Step 3: Determine whether an account was compromised

Review identity-provider and email audit logs for suspicious sign-ins, unfamiliar devices, unusual locations, unexpected authentication changes, and activity inconsistent with the account's normal behaviour.

Investigate whether the attacker created mailbox rules, configured forwarding, accessed unusual conversations, or sent messages to additional recipients.

If the sender is a legitimate supplier, the investigation may require coordination with that supplier's security team.

Step 4: Identify the scope

Search for related messages across the organisation using sender addresses, reply-to addresses, lookalike domains, message IDs, subjects, and other relevant indicators.

Identify employees who received or responded to the messages, and determine whether other payment requests or confidential information requests were involved.

Step 5: Establish the business impact

Coordinate with finance, procurement, payroll, or legal teams to determine whether any payments were initiated, supplier details changed, or confidential documents disclosed.

If a transfer has occurred, contact the relevant bank and follow the organisation's financial fraud response process immediately. Rapid reporting may improve the opportunity to intervene, although recovery is not guaranteed.

Step 6: Contain the compromise

Depending on the evidence, actions may include blocking malicious sender infrastructure, quarantining related messages, disabling or restricting a compromised account, revoking sessions, resetting credentials, and removing unauthorised mailbox rules.

If the incident involves a lookalike domain rather than a compromised account, containment should focus on the fraudulent communications and the affected business process.

Step 7: Recover and prevent recurrence

Restore legitimate mailbox settings, verify affected identities, confirm supplier payment details through trusted channels, and monitor for repeated attempts.

Document the attack timeline, evidence, impact, containment actions, and any gaps in email security or financial approvals.

7. Indicators and Evidence to Look For

BEC does not have one universal indicator of compromise. Investigators should correlate email, identity, mailbox, and financial records.

Evidence sourceWhat to investigateEmail headersLookalike domains, unusual reply-to addresses, sender inconsistencies, and message routingSPF, DKIM, and DMARCAuthentication results and possible domain spoofingIdentity logsUnusual sign-ins, suspicious authentication changes, and account compromise indicatorsMailbox audit logsUnexpected forwarding rules, configuration changes, and unusual message activityEmail security logsSimilar messages, related recipients, and suspicious communication patternsFinancial recordsUnauthorised transfers, altered supplier details, and suspicious payment requestsSupplier correspondenceDifferences between the fraudulent request and independently verified instructions

No single indicator proves BEC. A new mailbox rule, for example, may be legitimate. Investigators must assess whether the activity was authorised and whether it aligns with the wider incident timeline.

8. MITRE ATT&CK Mapping

The following techniques may be relevant when supported by evidence from the incident.

TechniqueIDRelevancePhishingT1566Deceptive messages used to initiate an attackSpearphishing LinkT1566.002Fraudulent links used to direct victims to deceptive destinationsValid AccountsT1078Compromised legitimate accounts used by an attackerEmail Forwarding RuleT1114.003Forwarding rules abused to monitor or redirect emailExternal Remote ServicesT1133Relevant when external remote access is abused as part of account compromise

BEC is primarily a fraud and social engineering category, so not every incident maps to all of these techniques. Use the specific behaviours observed rather than assigning techniques based on the BEC label alone.

9. How Organisations Can Prevent BEC

Effective BEC defence requires both technical security and reliable financial processes.

Verify payment changes independently. Confirm new bank details using a previously verified telephone number or another trusted channel. Do not rely on contact information supplied in the suspicious email.

Require dual approval for high-value transfers. Separate payment initiation from payment authorisation and enforce documented approval thresholds.

Protect business email accounts. Use multifactor authentication, preferably phishing-resistant methods where feasible, and monitor unusual sign-ins.

Deploy email authentication controls. Configure SPF, DKIM, and DMARC appropriately to reduce certain forms of domain spoofing.

Monitor mailbox changes. Alert on suspicious forwarding rules, unexpected delegates, unusual inbox rules, and changes to account security settings.

Use domain and sender monitoring. Investigate lookalike domains and messages that impersonate executives, suppliers, or finance personnel.

Train employees on verification. Teach staff to recognise urgency, secrecy, unexpected payment changes, and requests that bypass established procedures.

Create a rapid reporting process. Make it easy to report suspicious messages and immediately escalate suspected fraudulent transfers.

Prepare a financial fraud response plan. Define who contacts the bank, who investigates the email, who informs affected suppliers, and who coordinates legal and regulatory obligations.

10. Lessons for Modern SOC Teams

BEC demonstrates why security monitoring cannot stop at malware detection.

A suspicious email may contain no malicious code, and a compromised mailbox may generate messages that appear completely legitimate. Detecting the incident therefore requires understanding identity activity, communication patterns, and the business action requested.

SOC teams should correlate email security alerts with authentication events, mailbox changes, and unusual financial requests. Where possible, detection rules should identify sequences of suspicious behaviour rather than relying only on known malicious indicators.

Incident response must also extend beyond IT. Finance, procurement, legal, and business leadership may hold the information needed to determine whether money or sensitive data was exposed.

Conclusion

Business Email Compromise succeeds by exploiting trust in business relationships and weaknesses in verification procedures. Whether an attacker impersonates an executive, alters supplier payment instructions, or abuses a compromised mailbox, the objective is to make a fraudulent request appear legitimate.

The most effective defence combines strong identity security, email monitoring, independent verification, and clear financial approval processes.

The key lesson: A familiar sender name is not proof of authenticity, and an urgent payment request should never bypass independent verification.

Further Reading

• FBI Internet Crime Complaint Center (IC3) — Business Email Compromise guidance and reporting resources.

• CISA — Email security, phishing prevention, and identity protection guidance.

• MITRE ATT&CK — Techniques relevant to phishing, account compromise, and email abuse.