Business Email Compromise (BEC): How It Works and How to Stop It

Business email compromise does not need malware or a suspicious link. It needs one convincing email, sent from a real or lookalike address at the right moment, asking someone in finance to change where a payment goes. This guide explains how BEC attacks unfold in Microsoft 365, the main types, how they differ from spear phishing and whaling, and the controls and processes that stop them, using two cases CyberQuell investigated.

‍

What Is Business Email Compromise (BEC)?

Business email compromise (BEC) is a type of fraud in which an attacker impersonates someone the victim trusts, such as a CEO, colleague, supplier or lawyer, to trick them into sending money or sensitive data. It is also called CEO fraud or invoice fraud.

BEC works because it rarely looks like an attack. There is usually no malware, no attachment and often no link, so email filters have little to catch. Instead, the email relies on authority, urgency and timing: a routine-looking request from someone the recipient already deals with.

It is also one of the costliest cybercrimes. The FBI’s 2025 Internet Crime Report recorded $3.05 billion in BEC losses from 24,768 complaints, second only to investment fraud. Between October 2013 and December 2023, the FBI counted $55.5 billion in reported BEC losses worldwide, a figure that includes attempted theft as well as money actually lost.

BEC is not limited to email. The FBI’s definition also covers attackers who take over phone numbers and virtual meeting apps to push fraudulent payments through.

Attackers target the people who move money or hold sensitive records:

• Finance and accounts payable staff
• Executive assistants
• HR and payroll teams
• Anyone who discusses payments with suppliers or clients

Is BEC a type of phishing? Yes. Business email compromise is a targeted form of phishing, but it usually carries no malicious link, which is why it slips past filters that catch ordinary phishing. The comparison with phishing, spear phishing and whaling is set out later in this guide.

‍

How Does a BEC Attack Work?

Most business email compromise attacks follow five stages: the attacker researches the target, gets access to a mailbox or creates a lookalike address, watches conversations, sends the fraudulent request at the right moment, then hides the evidence.

1. Research. Attackers study company websites, LinkedIn profiles, press releases and supplier names. Within an hour they can usually work out who approves payments and who they deal with.
2. Get a foothold. The attacker either registers a lookalike domain or free email address, or takes over a real mailbox through phishing, password reuse or session token theft. A stolen session token lets the attacker skip the multifactor authentication (MFA) prompt entirely, which is explained in our guide to how attackers steal session tokens to get past MFA.
3. Watch. Inside a compromised mailbox, attackers read threads quietly, sometimes for weeks. They learn invoice dates, payment amounts and how people write to each other.
4. Strike. The attacker sends a request to change bank details, pay an urgent invoice or buy gift cards. It is timed to a real payment and often sent inside an existing email thread, so it looks like part of a normal conversation.
5. Hide. Inbox rules move or delete replies, so the real mailbox owner never sees clients or suppliers asking questions about the new bank details.

The hiding stage is what lets BEC run for months. In a four-month BEC campaign CyberQuell investigated, hidden Outlook rules diverted client replies away from a bookkeeper’s inbox. The attacker kept access through a password reset and session revocation, and was only removed once the full persistence was found.

‍

What Are the Main Types of BEC Attacks?

The main types of business email compromise are CEO fraud, account compromise, supplier invoice fraud, attorney impersonation, payroll diversion and data theft. They differ in who is impersonated and what is requested, but all rely on trust and urgency.

Microsoft lists CEO fraud, account compromise and attorney impersonation among the most common BEC scams. Attackers often wait for busy moments, such as a major deal or the end of a quarter, when scrutiny is lowest.

Every type arrives in one of two ways. Either the email comes from a lookalike address outside your systems, or it comes from a compromised mailbox inside them. The second is harder to spot, because the email is genuinely from the person it claims to be.

Supply chain BEC is a version of the second route. A supplier’s mailbox is compromised, and the attacker uses it to send you a real-looking invoice with new bank details.

Book a call with CyberQuell to check your Microsoft 365 mailboxes for the inbox rules, forwarding and sign-ins that signal BEC.

‍

What Is the Difference Between BEC, Phishing, Spear Phishing and Whaling?

Phishing is a mass email trying to fool anyone, spear phishing targets a specific person, and whaling targets senior executives. Business email compromise is the fraud that often follows: a targeted, usually link-free email that asks for money or data while posing as someone trusted.

Is whaling spear phishing? 

Yes. The UK’s National Cyber Security Centre (NCSC) describes whaling as a type of spear phishing aimed at senior people, such as board members with access to valuable assets.

A typical spear phishing email goes to a named accounts payable clerk, mentions a real supplier, and asks them to sign in to view an invoice. The sign-in page is fake, and the stolen password becomes the attacker’s way into the mailbox. That is how many BEC attacks begin.

The key difference is the goal. Phishing, spear phishing and whaling describe how an attacker reaches a person. BEC describes what they do once they have that person’s trust: ask for a payment or data that looks routine. Because BEC emails often contain nothing malicious to scan, the defences that stop phishing emails in Microsoft 365 need to be paired with payment checks and mailbox monitoring.

‍

What Do Real BEC Attacks Look Like? Two Cases CyberQuell Investigated

CyberQuell has investigated both forms of business email compromise: a lookalike-address attack that redirected a $5,562.50 payment without touching the client’s systems, and a mailbox takeover that lasted four months and attempted more than $150,000 in fraud.

In the exhibitor payment redirect case, the attacker’s address read firstname.lastname.companydomain@mail.com. Placing the company name before the @ made it look genuine at a glance. The client feared a breach, but the logs showed no one had touched its Microsoft 365 tenant.

The multi-phase BEC campaign was the opposite. The emails came from the bookkeeper’s real mailbox, so every authentication check passed and clients had no reason to doubt them.

Three lessons from both cases:

1. Email authentication proves where an email came from, not that the sender is honest.
2. A password reset alone may not remove an attacker who holds a stolen session or app access.
3. One phone call on a known number would have stopped both payments.

‍

What Are the Warning Signs of a BEC Attack?

For staff, the warning signs of business email compromise are urgent or secret payment requests and any change of bank details by email. For IT, they are new inbox rules, new forwarding, unfamiliar MFA methods and sign-ins from unusual places.

Signs in the email (for finance and staff):

• New or changed bank details, especially on a familiar invoice
• Urgency or secrecy, such as “keep this between us” or “this must go today”
• An address or domain that is one or two characters off from the real one
• A request to keep the conversation on email rather than a call
• An executive or supplier who “cannot take calls” right now

Signs in Microsoft 365 (for IT):

Microsoft’s list of compromised mailbox symptoms includes:

• Inbox rules that forward mail to unknown addresses, or move messages to the Notes, Junk Email or RSS Subscriptions folders
• Newly added external email forwarding
• Suspicious messages in Sent Items or Deleted Items
• Frequent password changes or unexplained account lockouts

Microsoft’s recovery steps add two more things to check: MFA methods the user does not recognise, and apps the user has given access to their account.

These are the signals CyberQuell’s security operations centre (SOC) alerts on around the clock. In one partner’s first six months, a suspicious inbox rule in an executive’s mailbox revealed a business email compromise that was contained in 4 minutes.

‍

How Do You Prevent Business Email Compromise in Microsoft 365?

Preventing business email compromise in Microsoft 365 takes three layers: make mailboxes hard to take over, make impersonation easy to spot, and make payment changes impossible to approve by email alone.

1. Use phishing-resistant MFA and Conditional Access. Standard app-based MFA was bypassed by session token theft in the multi-phase case. Passkeys or FIDO2 security keys, enforced through Conditional Access, close that gap.
2. Turn off legacy authentication. Older email protocols cannot perform MFA, so a stolen password alone gets in. They were still switched on in the multi-phase case.
3. Switch on impersonation protection in Microsoft Defender for Office 365. User and domain impersonation protection is only available in Defender for Office 365, not in the basic protection every mailbox gets, and no one is protected until you add them. Add your executives, finance staff and key supplier domains, then set an action such as quarantine. Microsoft 365 Business Premium already includes Defender for Office 365 Plan 1, so most companies of 50 to 500 people already own it. Our guide explains which Defender for Office 365 plan you need.
4. Publish SPF, DKIM and DMARC for your own domains. These stop attackers sending as your exact domain. They do not stop lookalike domains, which can pass all three checks.
5. Block automatic external forwarding. In the outbound spam policy, set forwarding to “Off - Forwarding is disabled”. The default setting can still allow forwarding in older Microsoft 365 tenants.
6. Restrict which apps users can approve. Rogue app access likely kept the attacker in place in the multi-phase case, even after a password reset.
7. Monitor mailboxes 24/7. Alert on new rules, forwarding, MFA changes and risky sign-ins. With qualifying licences, automatic attack disruption in Microsoft Defender XDR can contain a BEC attack while it is in progress.
8. Fix the payment process. Confirm any new or changed bank details by phone, on a number already on file, and require two people to approve large or first-time payments. The NCSC advises verifying important email requests through a second type of communication.

No single control covers both forms of BEC, but phone verification comes closest. CyberQuell delivers email security with Microsoft Defender for Office 365, backed by SOC monitoring that responds within 15 minutes to critical and high-severity alerts.

‍

What Should You Do If You Suspect a BEC Attack?

If you suspect business email compromise, call your bank first to stop or recall the payment, then lock the mailbox down: disable the account or reset the password, revoke sessions, and remove any rules, forwarding, MFA methods and apps the attacker added.

The first 24 hours:

1. Contact your bank immediately and ask it to freeze or recall the transfer. The FBI’s 2025 Internet Crime Report says that when you discover a fraudulent transfer, “time is of the essence”.
2. Disable the account, or reset the password if you cannot disable it. Never send the new password by email, because the attacker may still be reading the mailbox.
3. Revoke all active sessions. A password reset alone does not end a session the attacker has already stolen.
4. Remove everything the attacker added: unknown MFA methods, apps the user approved, admin roles, mailbox forwarding and inbox rules, including hidden ones. Microsoft’s guide to responding to a compromised email account covers each step.
5. Check who else received fraudulent emails using message trace, and warn affected clients and suppliers by phone, not email.
6. Preserve the logs, including sign-ins, the audit log and the mailbox audit log, before they age out.
7. Report it. In the US, file a complaint at ic3.gov. In the UK, report at gov.uk/report-cyber and follow the NCSC’s business payment fraud guidance.
8. Check your cyber insurance. The NCSC warns that some policies do not cover money lost through business email compromise, so read the wording before you assume you are covered.

These steps work best when they are written down before you need them. An incident response plan should name who calls the bank, who locks the account and who talks to clients. It is also worth checking what cyber insurance covers now, rather than after a loss.

‍

Business Email Compromise in the UAE

UAE businesses in Dubai and Abu Dhabi face the same two forms of business email compromise as the US and UK, and the same Microsoft 365 controls and payment checks stop them.

The eight controls above apply unchanged. Impersonation protection, legacy authentication turned off, forwarding blocked and phone verification of bank changes matter just as much in a Dubai finance team as in a London or New York one.

For the configuration detail, our Microsoft 365 email security checklist for UAE businesses walks through the settings layer by layer. For round-the-clock mailbox monitoring and response, CyberQuell provides managed security services in the UAE on Microsoft Sentinel and Defender XDR, with a 15-minute response SLA.

‍

Final Thoughts

Business email compromise succeeds because it looks like normal business: a familiar name, a real thread, an invoice that is almost right. Technology makes mailbox takeover and impersonation much harder, but a phone call on a known number before any bank change is what actually stops the payment. The strongest position combines both, with someone watching mailboxes for new rules, forwarding and risky sign-ins around the clock through 24/7 SOC monitoring.

Book a call with CyberQuell to protect your Microsoft 365 mailboxes and payments from business email compromise with Defender for Office 365 and 24/7 SOC monitoring.