Business email compromise

What it means

Business email compromise is an attack in which a fraudster poses as someone the company trusts and persuades it to pay into the fraudster’s account. Most often it is a known supplier who has “changed banks”, or a director who urgently needs a payment sent while travelling.

Unlike mass phishing, the attack is targeted and patient. The attacker often first gains access to a real mailbox of the supplier or the company, reads the correspondence for weeks and then sends a message in the right tone, in a genuine thread and with a real invoice on which only the bank account number has been changed.

It is a form of social engineering: the attack exploits trust, haste and deference to authority rather than a technical flaw. That is why even the best antivirus will not stop it if the person on the other side has no clear procedure for verifying such a request.

How it works in practice

The rule we recommend to every client: a change of a supplier’s bank account is always verified by phone on a number the company already has, never one taken from the email. The same goes for any unusual payment “on the director’s instruction”, especially if it bypasses the normal process and comes with time pressure.

On the technical side, setting up SPF, DKIM and DMARC makes it harder to spoof the company’s own domain, and two-factor authentication on email means a stolen password is not enough to take over a mailbox. A banner flagging mail from external senders also helps.

In the accounts, changes to suppliers’ bank details are recorded and approved separately from the payments themselves. Whoever enters a payment order should not be the same person who changes the account number in the master data, and larger amounts merit a second approval.

What to watch out for

With an instant payment the money reaches the fraudster’s account within seconds and is moved on before the company notices. If fraud happens, call the bank at once, ask for the payment to be stopped and recalled and report it to the police, because every hour counts.

A loss from fraud is not automatically a deductible expense, and insurance covers it only sometimes. Cyber insurance often excludes voluntarily sent payments or covers them only up to a low limit, so it is worth checking the terms before anything happens.