What is BEC?

What is BEC?

Business email compromise (BEC) is a targeted social engineering attack aimed at an organization's money or data. The attacker either impersonates someone the victim trusts, such as an executive, a vendor, a lawyer or a coworker, or actually takes control of that person's mailbox. Then the attacker sends a believable request: pay this invoice to a new bank account, wire funds for a confidential deal, change my direct deposit details, buy gift cards for a client, or send employee tax records.

BEC messages often contain no malware and no links, only plain text from what looks like a familiar sender. That is why spam and attachment filters miss many of them, and why the business process around payments matters as much as the technology.

Common BEC patterns

• Executive impersonation (CEO fraud): a message that appears to come from a senior leader asks finance staff for an urgent, secret wire transfer.
• Vendor or invoice fraud: the attacker poses as a real supplier and says its bank details have changed, so the next payment goes to the attacker.
• Account compromise: an employee's real mailbox is taken over, usually after a credential phishing email, and used to send payment requests to that employee's contacts.
• Payroll diversion: a fake request from an employee asks HR or payroll to send direct deposit to a new account.
• Data theft: requests for employee records, tax forms or customer lists instead of money.

How attackers make it convincing

• Lookalike domains that differ from the real one by a single character, a swapped letter or an extra hyphen.
• Display name spoofing: the friendly name shows the executive's name while the actual address is a free webmail account.
• Reply-to tricks that send answers to a different address than the one shown.
• Mailbox rules created inside a compromised account to forward, hide or delete replies so the real owner does not notice.
• Pressure: urgency, authority and secrecy, such as "I'm in a meeting, get this done today and keep it quiet."

Defenses

• Out-of-band verification: confirm any payment request or bank detail change by calling a known phone number on file, never a number supplied in the email.
• Payment controls: require two people to approve wire transfers and changes to vendor or payroll banking details.
• MFA on email accounts, which blocks most account takeovers that start with a stolen password.
• SPF, DKIM and DMARC on your domain. With DMARC set to quarantine or reject, attackers have a much harder time sending mail that exactly spoofs your own domain. These records do not stop lookalike domains or mail sent from a genuinely compromised account.
• External sender tags or banners on mail from outside the organization, plus regular user training.
• Monitoring for new forwarding rules and sign-ins from unusual locations.

BEC on the CompTIA A+ exam

BEC is on the shared A+ acronym list and is mainly Core 2 social engineering material. SPF, DKIM and DMARC appear in Core 1 objective 2.4 under spam management, so the two topics can meet in email security questions.

• If an email from the "CFO" urgently asks accounting to wire money or change a vendor's bank account, think BEC.
• The best answer for preventing the loss is usually verifying the request through a separate, known channel.
• If the scenario says the attacker signed in to a real employee mailbox, MFA is the control most likely to have prevented it.
• Phishing is the broad category, spear phishing targets specific people and whaling targets executives. BEC is a fraud scheme that often starts with spear phishing or whaling.