Understanding business email compromise
Business email compromise is a targeted cyberattack where criminals impersonate someone you trust—like your CEO, a vendor, or a business partner—to trick you into sending money or revealing confidential information. The FBI's Internet Crime Complaint Center reports BEC attacks caused nearly $8.5 billion in losses over the last three years. Unlike typical phishing emails that blast out malicious links to thousands of people, BEC attacks are carefully crafted for specific individuals within your organization.
The key difference between BEC and regular phishing is precision. Phishing casts a wide net hoping someone clicks a bad link. BEC is more like a sniper—one carefully aimed shot at the right person at the right time. These attacks work because they look and feel like normal business communications, often referencing real projects or recent company announcements to seem legitimate.
Cloud Threat Report 2025
Get deeper insights into evolving BEC tactics and cloud security threats.
How BEC attacks work in modern environments
A BEC attack doesn't start with the fraudulent email you eventually receive. It begins weeks or even months earlier with reconnaissance. Attackers study your organization through public sources like LinkedIn, your website, and press releases to identify the best targets—usually people in finance, HR, or executive roles who have access to money or sensitive data. They learn who reports to whom, what projects you're working on, and even the language your team uses in emails.
Once they've done their homework, attackers move to compromise an email account using stolen credentials from a previous data breach or a separate phishing email. When they gain access to a real email account, they can read through months of conversations to understand your business relationships and payment processes.
After getting inside, attackers set up persistence mechanisms to maintain their access. They create email rules that forward or hide messages, enable external forwarding to personal accounts, generate app-specific passwords that bypass MFA, grant OAuth consent to malicious applications, or add delegated 'Send-As' permissions. These persistence mechanisms let attackers maintain access even after password resets, making thorough remediation critical.
The final stage is execution. Armed with context from real email threads, the attacker sends their fraudulent request. They time it carefully—targeting periods when executives are traveling (creating 'impossible traveler' login patterns), during quarterly close when finance teams rush to process payments, or across time zones to exploit gaps in verification workflows.These timing patterns often trigger identity analytics alerts if you're monitoring for anomalous access.
Common types of BEC attacks and tactics
BEC isn't just one type of scam. Attackers use several different approaches depending on their target and goals.
CEO fraud
In CEO fraud, the attacker pretends to be your company's CEO or another executive. They send an urgent email to someone in finance asking for an immediate wire transfer, often claiming it's for a confidential acquisition or time-sensitive deal. The employee feels pressured not to question a direct order from the boss.
Invoice fraud
Invoice fraud targets your payment processes, with vendor email compromise attacks surging 66% in recent months. Attackers impersonate a vendor you regularly work with and send a fake invoice or a message saying their bank account details have changed.
Account compromise
When attackers fully compromise an employee's email account, they can send payment requests to your customers or partners from a trusted address. These attacks are especially hard to detect because the emails come from a legitimate account that everyone recognizes.
Attorney impersonation
Scammers pose as lawyers handling a confidential legal matter for your company. They contact mid-level employees and claim they need an urgent payment for legal fees or a settlement. The supposed confidentiality discourages the employee from verifying the request with others.
Data theft
Not every BEC attack goes after money directly. Some target HR departments to steal employee W-2 forms or payroll information. Attackers can use this data for identity theft or sell it to other criminals.
See Wiz in Action
Learn how Wiz detects and prevents credential compromise across your cloud environment.
Book personalized demo
Why BEC attacks are difficult to detect
BEC attacks slip past your security tools because they don't look like traditional cyberattacks. Most email security systems scan for malware, suspicious attachments, or known malicious links. BEC emails often contain none of these—many are plain text that looks like a normal business request. Some sophisticated attacks include legitimate-looking invoices or hijack existing email threads with attachments, making them even harder to distinguish from routine business communications.
Attackers often use legitimate email services or compromised real accounts to send their messages. When an email comes from a trusted domain or from someone you actually know, both your security tools and your employees are more likely to trust it. Standard email authentication checks won't flag these messages as suspicious.
The real power of BEC is social engineering—attackers manipulate emotions like urgency and authority to bypass both technical controls and human judgment. Understanding how attackers steal and abuse credentials helps you build layered defenses that address both the initial compromise and post-compromise activity. This psychological manipulation is much harder to defend against than technical threats.
Sophisticated attackers also study how your team communicates, with 40% of BEC emails now AI-generated to better mimic authentic business correspondence. They learn the tone and style of your executives' emails, the jargon your industry uses, and even the signature format your company prefers. This attention to detail makes their fake emails nearly impossible to distinguish from real ones.
Mailbox indicators of BEC compromise
If you suspect a BEC attack, audit affected mailboxes for these red flags:
Inbox rules: Unexpected rules that forward, delete, or move messages to obscure folders
External forwarding: Auto-forwarding enabled to external email addresses
OAuth consents: Recently granted permissions to unfamiliar third-party applications
App passwords: Newly generated app-specific passwords that bypass MFA
Delegated access: New mailbox delegates, Send-As, or Send-on-Behalf permissions
MFA changes: Recent MFA device registrations or authentication method resets
Login anomalies: Sign-ins from unusual locations, impossible traveler patterns, or unfamiliar IP addresses
Disabled alerts: Security notifications or audit logging turned off
Check your email security logs for these indicators within 90 days of suspected compromise. Most BEC attackers establish persistence within the first 24-48 hours of account access.
What is Managed Threat Hunting?
Managed threat hunting is a proactive security service where experts search for hidden threats automated tools miss, reducing dwell time and potential damage.
Read more
Comprehensive BEC prevention strategies
Stopping BEC requires multiple layers of defense that address both technology and human behavior. You can't rely on just one security measure.
Multi-factor authentication
Multi-factor authentication (MFA) is your first line of defense against account takeover. Favor phishing-resistant methods like FIDO2 security keys or WebAuthn passkeys over SMS-based codes, which attackers can intercept through SIM-swapping. Enforce MFA on all email accounts and systems that handle financial transactions. Even if an attacker steals someone's password, they can't access the account without the physical security key or biometric authentication.
Payment verification protocols
Create a mandatory rule that all payment requests and banking detail changes must be verified through a separate channel—call the vendor at a known number, never one provided in the email. Implement dual control (two-person verification) for transactions above $10,000 or any changes to vendor banking information. This segregation of duties ensures no single compromised employee can authorize fraudulent payments.
Finance control baseline for BEC prevention
Implement these payment controls to reduce BEC risk:
Dual approval: Require two-person verification for wire transfers above $10,000 and all vendor banking changes
Out-of-band verification: Call vendors at pre-established numbers (never from the email) to confirm payment requests
Vendor master lock: Restrict who can add or modify vendor records in your ERP system
Positive pay: Enable positive pay or ACH filters with your bank to match payments against authorized lists
Payment cut-off times: Establish daily wire transfer deadlines to allow time for verification
Role-based training: Provide BEC-specific training to procurement, accounts payable, and treasury teams
Change notification: Alert multiple stakeholders when vendor payment details change
Document these controls in your payment policy and audit compliance quarterly. Most BEC losses occur when organizations have informal or inconsistently applied payment processes.
Email authentication
Deploy SPF, DKIM, and enforce DMARC with a policy of p=quarantine or p=reject to prevent attackers from spoofing your domain. DMARC in monitor-only mode (p=none) provides visibility but won't block fraudulent emails—you must set an enforcement policy to actively protect recipients from domain spoofing.
Security awareness training
Train your employees to recognize BEC tactics. Teach them to be suspicious of urgent requests, especially those involving money or sensitive data. Make sure they know it's okay—even encouraged—to verify unusual requests, even if they appear to come from executives.
Vendor management procedures
Establish secure communication channels with all your vendors for financial matters. Any request to change payment information should trigger a verification process that involves multiple people and confirmation through a trusted channel like a phone call to a known contact.
BEC incident response and investigation
When you detect a BEC attack, act fast. Reset passwords for compromised accounts, revoke active sessions and OAuth tokens, and remove suspicious inbox rules or forwarding. Contact
your bank immediately to recall fraudulent transfers—most banks can stop payments within 24 hours if notified quickly.
Next, investigate the scope. Review email logs to see what the attacker accessed and how long they had access. Correlate mailbox artifacts—like OAuth consents, inbox rules, and login patterns—with cloud audit logs, data access trails, and runtime signals to understand blast radius quickly. If the compromised account had cloud access, check for privilege escalation attempts, unusual API calls, or lateral movement to other workloads.
Report the incident to the FBI's IC3 (ic3.gov), notify your cyber insurance carrier, and inform affected parties as required. Preserve all evidence—suspicious emails, logs, and related data—for law enforcement and insurance claims. Finally, implement stronger controls based on what you learned and update your incident response plan to prevent future attacks.
What is Incident Response? A Fast-Track Guide for SOCs
Incident response is a strategic approach to detecting and responding to cyberattacks with the goal of minimizing their impact to your IT systems and business as a whole.
Read more
How Wiz protects against BEC cloud compromise
BEC attacks start in email, but their damage often extends to your cloud infrastructure when attackers steal credentials. A compromised employee account becomes a key that can unlock your entire cloud environment.
Wiz's comprehensive cloud security platform provides robust capabilities in threat detection, incident response, and posture management that collectively strengthen your defenses against BEC attacks—even without a dedicated BEC product. Our platform approach integrates proactive monitoring, advanced forensics, continuous posture management, and intelligent attack path analysis to help you mitigate and respond to BEC incidents:
Proactive threat detection: Wiz Defend's Malicious IP & Domain Detection uses threat intelligence to identify suspicious IP addresses and domains associated with BEC activities like phishing infrastructure or command-and-control servers before they compromise your cloud environment.
Post-incident investigation and response: Wiz Forensics provides blast radius analysis, virtual machine volume copying for evidence preservation, and automated forensic package collection to help you quickly assess the scope of compromise and contain the threat.
Cloud security posture management and IAM security: Wiz continuously monitors for cloud misconfigurations and anomalous IAM permissions that attackers exploit after stealing credentials. Our Cloud Infrastructure Entitlement Management (CIEM) ensures employees only have the minimum permissions they need, limiting the blast radius of any compromised account.
Data exfiltration prevention: Wiz's Issues and Reports settings include controls to restrict email recipient domains, while our Data Security Posture Management (DSPM) maps sensitive data locations and effective access paths—showing not just who has permissions, but who can actually reach data through network routes, misconfigurations, and privilege chains.
Attack path analysis: The Wiz Security Graph maps relationships between cloud assets, revealing how a compromised identity could traverse misconfigurations, vulnerabilities, and network exposures to reach sensitive data. Instead of treating each risk in isolation, the graph shows which combination of issues creates critical paths from compromised credentials to your crown jewels.
Runtime monitoring: Lightweight runtime sensors detect malicious activities like cryptomining, process injection, suspicious shell execution, or reverse shells when attackers use stolen credentials to access your workloads—without agents or performance overhead.
By connecting these capabilities, Wiz transforms your incident response from reactive cleanup to proactive defense. Get a demo and see how unified visibility and risk-based prioritization stop credential theft from becoming a cloud breach. We'll show you exactly how compromised accounts could reach your sensitive data—and how to cut off those paths before attackers exploit them.
Stop BEC attacks before they reach your cloud
See how unified cloud security stops credential theft from becoming a breach.
