Business Email Compromise: How It Works and How to Stop It

Business email compromise (BEC) is fraud carried out through email. A criminal either takes over a real mailbox or convincingly impersonates someone you trust, such as a director, a supplier or your solicitor, and uses that trust to move money or extract data. The NCSC describes it as payment diversion fraud, and the label fits: the goal is usually to get one payment sent to the wrong account.

This guide is for the people who own the risk: finance directors, managing partners, operations leads and the IT managers who report to them. It explains how attacks unfold, why standard defenses miss them, which controls are worth paying for, and what to do in the first hours after an incident.

TL;DR

• BEC relies on trust, not malware. Many messages contain no malicious link or attachment, so filters often let them through.
• In the UK it is a leading insurance loss: 46.4% of UK cyber claims in 2024 in one major insurer’s data.
• The control that works is independent verification of every change to payment details, using a phone number from your own records.
• If a mailbox is compromised, resetting the password is not enough. Remove forwarding rules, delegates and app passwords, and start your ICO clock in parallel with recovery.

Table of Contents

• What business email compromise actually is
• How big the problem is in the UK
• The anatomy of an attack
• Why awareness training alone is not enough
• Controls that make a real difference
• A quick comparison of defenses
• What we see from the security side
• If you think a mailbox or payment has been compromised
• Sector notes
• Building a response that works before you need it
• How Zero Through can help
• FAQ
• Sources

What business email compromise actually is

There are two broad forms, and many attacks combine them.

Impersonation. The attacker registers a look-alike domain, or spoofs a display name, and writes as your chief executive, a supplier or a client. Nothing of yours is breached. The email simply looks right at a glance.

Account takeover. The attacker obtains a real login, often through a phishing page that imitates a Microsoft 365 sign-in, and then reads the mailbox. This is the more dangerous form. They study how you talk, who approves payments and when invoices are due. Then they reply inside a genuine conversation thread, from a genuine address.

The NCSC notes that these messages are tailored to your organization and impersonate people you correspond with regularly, which is why they feel ordinary. The NCSC’s guidance on targeted phishing against senior executives and budget holders is a useful companion read for boards.

How it differs from ordinary phishing

Mass phishing casts a wide net and wants a click. BEC targets one person in one role and wants an action: a transfer, a changed bank detail, a list of employee tax records, a batch of gift cards. Because the email often has no payload, automated tools that hunt for bad links and attachments have little to flag. The defense has to include people, process and monitoring, not only a filter. Our guide to phishing tactics for international business teams covers the wider family of lures.

How big the problem is in the UK

Exact national figures vary by source and year, so treat any single number as one view of the problem. Two data points are worth knowing.

• In the 2025 Coalition Cyber Claims Report, BEC made up 46.4% of UK cyber insurance claims in 2024, with an average loss of $22,000 per incident. That is insured businesses only, and it is one insurer’s book, but it shows how often this fraud is the first thing to go wrong.
• The Fraud Advisory Panel reported that payment diversion, also called mandate fraud, involved business email compromise in about 37.5% of reports in its 2022 update. The figure is older, but it shows how closely the two are linked.

An average loss of $22,000 understates the tail. A single diverted property completion payment, supplier invoice or payroll run can be many times that, and the average does not count staff time, regulatory exposure or lost client trust.

The anatomy of an attack

Most incidents follow a similar sequence. Knowing it tells you where to place controls.

1. Reconnaissance. The attacker reads your website, LinkedIn and press releases to learn who approves payments, who your suppliers are and when you are busy.
2. Initial access. A phishing email, a reused password from an old breach, or a sign-in prompt approved by a tired user gives them a mailbox.
3. Persistence. They create hidden inbox rules, add delegates or generate app passwords. The NCSC and others warn that attackers use these to keep access even after a password change.
4. Observation. They wait, sometimes for weeks, reading threads about invoices and deals.
5. The ask. At the right moment they send revised bank details, an urgent request from a director, or a payroll change.
6. Cash-out. Funds move through mule accounts within hours. Speed matters for recovery.

The warning signs people actually see

• A supplier announces new bank details, often with a plausible reason such as an audit or a bank change.
• A senior person asks for an urgent, confidential payment and says they cannot take calls.
• A reply arrives in an existing thread, but the tone or sign-off is slightly off.
• A sender address differs by one character from the real domain.
• Colleagues report emails they never sent, or mail that vanishes from the sent folder.

None of these is proof alone. That is the point: you need a process that does not depend on anyone spotting the fake.

Why awareness training alone is not enough

Training matters, and simulated phishing and user awareness work are part of a sound program. But BEC often exploits a trusted relationship rather than a suspicious link. The Coalition report and practitioners cited in the research point toward layers: technical controls such as phishing-resistant sign-in and least-privilege access, plus mandatory verification steps for payments.

The NCSC takes a similar view in its phishing guidance. Businesses should not expect staff to spot every fraudulent email. Instead, build a culture where people report anything odd without fear of blame, and rehearse your response so that when something gets through, you act quickly. The NCSC points to its Exercise in a Box for that rehearsal.

Controls that make a real difference

1. Verify payment changes out of band

This is the single most effective control, and it costs almost nothing. Any request to change bank details, or to make an unusual payment, is confirmed by calling a known contact on a number held in your own records. Never use a number from the email in question.

Set it as a rule that applies to everyone, including the chief executive. Rules with exceptions for seniority are exactly what impersonators exploit.

2. Do not lean on Confirmation of Payee

Bank name-matching checks are useful against some errors and scams, but they do not solve BEC. If the criminal is using a legitimate account, or impersonating a verified contact, the name can match perfectly. Treat the check as one input, not as clearance.

3. Harden sign-in

• Use multi-factor authentication on every mailbox, and prefer phishing-resistant methods such as passkeys or security keys for finance staff, executives and administrators.
• Block legacy protocols and review or disable app passwords, which can bypass MFA.
• Apply conditional access so that sign-ins from unusual countries or unmanaged devices are challenged or blocked.

4. Limit what a stolen mailbox can do

Least privilege applies to email too. Finance mailboxes should not have broad delegate access, and shared inboxes should be reviewed quarterly. Restrict automatic external forwarding at tenant level so that one hidden rule cannot quietly copy everything to an outside address.

5. Authenticate your own domain

SPF, DKIM and DMARC at an enforcement policy make it harder for criminals to send mail that appears to come from your exact domain. They do not stop look-alike domains, so pair them with monitoring for newly registered names similar to yours.

6. Watch behavior, not only content

Because the email itself may look clean, detection has to look at what happens around it: a sign-in from a new location followed by a new inbox rule, or mass reading of finance threads. This is where continuous monitoring earns its keep. We explain the principles in cyber threat detection for UK businesses and SOC cybersecurity for businesses across borders.

7. Know your supplier and client exposure

Your suppliers’ mailboxes are part of your risk. If a supplier is compromised, the fake invoice arrives from a genuine address. Agree with key suppliers how bank detail changes are communicated, and keep a verified contact list for each.

A quick comparison of defenses

No row is sufficient by itself. The first and the last together cover the most ground: a firm process that stops the money, and detection that catches the intruder.

What we see from the security side

We treat BEC as a business process problem that happens to arrive through technology. When we review an organization, the weakest point is rarely the email gateway. It is the gap between how finance believes payments are verified and how they are verified on a busy Friday afternoon.

Three things recur. First, multi-location businesses run different payment habits in different offices, so a control that works in head office is absent elsewhere. Second, mailbox settings are almost never audited, so hidden rules and delegates survive for months. Third, nobody has rehearsed who calls the bank, who calls the regulator and who preserves the evidence.

Our advice is to fix those in order of cost: write the verification rule, audit the mailboxes, then add monitoring that watches for the behaviors an intruder cannot avoid. And when we explain findings, we aim for plain language and a prioritized roadmap, because a report nobody can act on does not reduce risk.

— Shirish

If you think a mailbox or payment has been compromised

Act in this order. Speed is the main variable in whether money can be recovered.

1. Stop and call your bank. Use the official number from your bank’s website or your account manager, not details from any email. Ask them to attempt to recall the payment and flag the receiving account. The NCSC’s business payment fraud advice says to contact your bank through verified channels and inform your IT team immediately.
2. Tell IT or your security provider and open an incident. Do not let the first people to know be the only ones. Assign one person to lead and keep a timeline.
3. Regain control of the account. Reset credentials from a clean device and sign out all sessions. Then check for forwarding rules, filters, delegates, connected apps and app passwords. The NCSC advises removing these because attackers use them to maintain access. Consumer-focused guidance such as this account takeover guide makes the same point about unrecognized forwarding rules and recovery details.
4. Preserve evidence. Keep the original emails with headers, sign-in logs and inbox rule changes. Do not delete anything, even embarrassing messages.
5. Report the crime. The NCSC points UK victims to Action Fraud, or Police Scotland if you are in Scotland.
6. Assess data exposure and the ICO deadline. If personal data was accessed, the reporting clock may already be running.

Do not let recovery delay regulatory reporting

A common mistake is to focus on getting systems back and leave the regulator for later. Under UK GDPR, a notifiable personal data breach must generally be reported to the ICO within 72 hours of becoming aware of it. Run notification and remediation as parallel workstreams.

Outsourcing your IT does not transfer that duty. The data controller remains responsible, as the ICO’s monetary penalty notice against DPP Law Ltd illustrates in a related incident. That case involved ransomware, not BEC, and resulted in a £60,000 fine after the ICO found security measures inadequate. The lesson carries over: regulators look at whether your safeguards and your response were appropriate.

If your recovery plan does not name who decides whether a breach is notifiable, and who files, write that down this week. Our piece on ransomware incident response sets out a response structure that adapts well to email incidents.

Sector notes

Law firms. Client money, conveyancing completions and settlement payments are prime targets, and clients often act on your emailed instructions without a second check. Publish a clear notice in engagement letters that you will never change bank details by email.

Financial services. Regulated firms face both the fraud loss and the conduct and data-protection consequences. Evidence of tested controls matters in any review.

Healthcare and charities. Payroll redirection and supplier invoices are common, and smaller finance teams mean fewer people to cross-check.

Retail and manufacturing. Supplier chains with many invoices and frequent bank changes give attackers cover. Verified supplier contact lists are essential.

Multi-location groups. Different entities, banks and approval routines create seams. Standardize the verification rule everywhere before anything else.

Building a response that works before you need it

A practical readiness checklist for the next quarter:

• Write a one-page payment verification policy with no exceptions, and have finance sign it.
• Audit every mailbox for forwarding rules, delegates and app passwords, starting with finance, executives and administrators.
• Move high-risk roles to phishing-resistant sign-in.
• Enforce DMARC and monitor for look-alike domains.
• Rehearse a BEC scenario with finance, IT, legal and leadership. The NCSC’s Exercise in a Box is a free starting point.
• Confirm who owns ICO notification and how to reach them out of hours.
• Check what your cyber insurance requires you to do, and how quickly, after an incident.

For broader context on where this sits among your other exposures, see our UK cyber security business risk guide and the overview of cyber risk for global businesses.

How Zero Through can help

BEC sits across email, identity, finance process and incident handling, so it rarely belongs to one team. We support multi-location businesses with an IT security audit that tests how your controls work in practice and delivers a clear, prioritized roadmap. For continuous detection of suspicious sign-ins and mailbox changes, our managed SOC services and MDR services watch your environment and respond when something looks wrong. If you would like to talk through your exposure, start from our global IT support page.

FAQ

What is the difference between BEC and phishing?

Phishing is the broad technique of tricking people with deceptive messages, usually at scale and often to steal credentials. BEC is a targeted fraud aimed at a specific person or role to obtain money or data, and it often uses no link or attachment at all. Phishing is frequently how the attacker gets into the mailbox that enables BEC.

What is the first stage of a BEC attack?

It usually starts with research on your organization, then gaining access to a mailbox or setting up a look-alike identity. Attackers learn who approves payments and which suppliers you use before they send anything. The visible fraudulent request comes last, sometimes weeks later.

What should I do if my business email is compromised?

Call your bank on a verified number, tell your IT or security provider, and regain control of the account from a clean device. Then remove unrecognized forwarding rules, delegates and app passwords, preserve evidence, and report to Action Fraud (or Police Scotland). If personal data was involved, assess ICO notification straight away.

Does changing the password stop the attacker?

Not on its own. Attackers often add hidden forwarding rules, delegates or app passwords that keep working after a reset. Audit those settings and sign out all active sessions as part of recovery.

Can we get the money back?

Sometimes, but only if the bank is contacted very quickly, because funds are moved on within hours. Recovery is never guaranteed, which is why preventing the payment through verification is far more reliable than relying on a recall.

Sources

• NCSC: Business payment fraud
• NCSC: Business email compromise, new guidance to protect your organisation
• NCSC: Phishing guidance
• Coalition 2025 Cyber Claims Report
• Fraud Advisory Panel: Fraud update 2, current risks
• ICO
• ICO monetary penalty notice: DPP Law Ltd
• Alston & Bird: ICO fines UK law firm following ransomware incident
• Beat the Scam: Email account takeover guide

Recommended

• Phishing Tactics for International Business Teams
• Cyber Security Risk: A Guide For Global Businesses
• Cyber Risk: A Practical Guide for Global Businesses
• Cyber Security: A Practical Guide for Global Businesses