Business Email Compromise is responsible for a disproportionate share of enterprise cybercrime losses, precisely because it rarely uses malware or malicious links a gateway might catch. Instead, it relies on impersonation and social engineering.
How BEC Attacks Are Constructed
A typical BEC attack spoofs or compromises the account of a trusted party — an executive, a finance team member, or a vendor — and requests an urgent wire transfer, a change in banking details, or sensitive data. Because the email often passes standard authentication checks (especially if it originates from a genuinely compromised vendor account), signature-based tools see nothing wrong.
Behavioral Detection
BEC detection works by analyzing communication graphs, tone, urgency, and financial intent within emails, flagging deviations from established interaction patterns instantaneously. When a CFO receives an unusual financial request from a "vendor," the system analyzes language tone, urgency markers, and historical interaction patterns to flag the anomaly.
Vendor and Supply Chain Compromise
A significant share of BEC originates not from spoofed internal accounts but from genuinely compromised vendor accounts. Attackers inject themselves into existing email threads and redirect invoice payments. Because these emails pass SPF/DKIM/DMARC checks (they're truly from the vendor's domain), detection depends on analyzing reply-to mismatches, sudden banking-detail changes, and deviations from the vendor's typical communication cadence — not authentication status.
Stopping the Fraudulent Transaction
The goal is to flag the anomaly before a payment is authorized, not after. This means BEC detection needs to operate at or before the point where a human makes the authorization decision — quarantining the message or surfacing a clear warning, rather than relying on retrospective review after funds have already moved.
Frequently Asked Questions
Can BEC be stopped by SPF, DKIM, and DMARC alone?
No. Those protocols verify the sending domain is authorized to send the message, but they don't detect impersonation via a genuinely compromised account, or content-based social engineering with no forged domain at all.
What's the highest-risk BEC scenario?
Executive or vendor impersonation requesting an urgent, unscheduled wire transfer or a change to existing payment/banking details — these combine urgency with a plausible pretext and are the pattern behind the largest reported losses.