Business Email Compromise (BEC) remains one of the most financially damaging attack categories for small and mid-sized businesses — and it often requires no malware, no exploit, and no technical vulnerability at all. It relies entirely on a compromised or convincingly spoofed email account and a moment of urgency.

How it typically unfolds. An attacker gains access to a mailbox (through a phished password or a previous breach) or registers a look-alike domain one character off from a real vendor. They study existing email threads, then insert themselves at exactly the right moment — often around an invoice, a wire transfer, or a request to update payment details — asking a finance or accounting employee to redirect funds to a new account.

Why it works. These messages don't trip antivirus or spam filters because there's no malicious attachment or link — just a convincing, well-timed request that matches the tone and context of a real business relationship.

Warning signs to train staff on: A request to change payment or banking details via email alone, unusual urgency ("this needs to go out today"), a slightly altered sender domain, and a request to bypass normal approval steps "just this once."

Recommended actions:

• Require verbal confirmation (a phone call to a known, previously verified number — not one provided in the email) for any request to change payment details or move funds
• Enable DMARC enforcement to reduce domain spoofing
• Train staff specifically on BEC patterns, not just generic phishing awareness
• Flag external email with a visible banner so staff can immediately see when a message originates outside the organization

‍