What Is Business Email Compromise? A Guide for UK Businesses

What Is Business Email Compromise?

Business email compromise, commonly abbreviated to BEC, is a category of cyber-enabled fraud in which attackers use email to manipulate employees, clients, or partners into transferring money or disclosing sensitive information. Unlike broad phishing campaigns that send millions of generic emails, BEC attacks are targeted — attackers research their victims, understand the organisation's structure and relationships, and craft emails that are genuinely convincing.

The FBI's Internet Crime Complaint Center consistently ranks BEC as the costliest category of cybercrime. In the UK, the NCSC and Action Fraud record thousands of BEC incidents annually, with losses frequently running to tens or hundreds of thousands of pounds per incident. Unlike malware attacks, BEC rarely triggers technical security controls — no malicious file is downloaded, no link to an obvious phishing site is clicked — making it particularly difficult to detect and prevent.

How BEC Attacks Work

BEC attacks generally follow a pattern:

**Reconnaissance** — Attackers research the target organisation. LinkedIn provides organisational charts, job titles, and reporting lines. Company websites reveal names, roles, and sometimes email formats. Companies House filings identify directors and significant shareholders. Published contracts, tenders, or news articles identify major suppliers and clients.

**Access or impersonation** — The attacker either gains access to a legitimate email account (through credential theft, phishing, or exploiting a weak password) or creates a convincing impersonation. Impersonation can involve a lookalike domain (yrzoai.dev becomes yrzo-ai.dev or yrzoai.co) or simply setting the display name to match an executive while using an unrelated email address.

**The request** — The attacker sends an email appearing to come from a trusted source — a CEO, a supplier, a client — making a specific, urgent request. Common scenarios include an executive urgently requesting a payment, a supplier notifying a change of bank details, a client requesting a callback on an unfamiliar number, or an HR request for employee payroll information.

**Execution** — An employee, believing the request is genuine, complies. Money is transferred to a fraudulent account, bank details are updated in the finance system, or sensitive data is emailed to the attacker.

Common BEC Scenarios

**CEO fraud** — An attacker impersonating the CEO or MD emails the finance team requesting an urgent and confidential payment — often framed as an acquisition deposit, a supplier payment requiring discretion, or a regulatory requirement. The urgency and the instruction not to discuss the payment with colleagues are hallmarks.

**Invoice fraud** — A supplier's email account is compromised, or a lookalike domain is registered. The attacker sends a legitimate-looking invoice to the target company with updated bank account details. The payment goes to the fraudster rather than the genuine supplier.

**Payroll diversion** — HR or payroll teams receive an email from an employee requesting a change to their bank account details before the next payroll run. The email appears to come from the employee but is sent by an attacker.

**Lawyer or legal impersonation** — Attackers impersonate solicitors handling a property transaction, share purchase, or settlement, requesting funds to be transferred to a client account. Property fraud using this method has cost UK homebuyers significant sums.

**Client impersonation** — An attacker who has compromised a client's email account monitors conversations for upcoming payments and intercepts at the right moment, redirecting funds.

Why BEC is Difficult to Stop

BEC attacks succeed for a combination of reasons:

They exploit authority and urgency — social engineering pressure that bypasses rational evaluation.

They often arrive from legitimate email accounts that have been compromised, so email filtering and domain checks do not flag them.

Even when impersonating a domain, display names are designed to pass a quick glance — few people check the actual email address behind a familiar name.

They target specific individuals in finance, HR, or executive assistant roles — people who genuinely process the types of requests being faked.

And they move at human speed. By the time the fraud is discovered, the funds have been moved multiple times and recovery is unlikely.

The Role of Website Security

Website security and BEC are connected in several ways:

**Domain spoofing** — BEC attacks that use lookalike or spoofed domains are made significantly easier when a target organisation has not implemented DMARC email authentication. A properly configured DMARC policy at enforcement (p=reject) prevents emails that spoof your domain from reaching recipients — protecting your clients and partners from impersonation attacks using your domain.

**Credential theft** — Many BEC attacks begin with compromise of a legitimate email account. That compromise often starts with phishing, credential stuffing, or exploitation of a weak password on a login page. A web security assessment that identifies weak authentication, missing brute-force protection, or credential exposure reduces the risk of the initial account compromise.

**Information gathering** — Attackers use public-facing websites, contact pages, and about pages to identify targets, understand organisational structure, and harvest email addresses. Minimising unnecessary personal information on public-facing pages reduces the reconnaissance value for attackers.

Prevention

**DMARC at enforcement policy** — Configure SPF, DKIM, and DMARC records on your domain, with DMARC at p=reject. This prevents your domain from being spoofed in email attacks against your clients and partners.

**Out-of-band verification for payment changes** — Establish a firm policy that bank account changes or large payment requests must be verified by phone using a number from an established source — not a number in the request email itself. This single control eliminates the majority of BEC fraud.

**Multi-factor authentication on email accounts** — MFA prevents attackers who obtain a password from using it to access and monitor email accounts.

**Staff training** — Finance, HR, and executive assistant teams need specific training on BEC scenarios. Simulated phishing exercises that include BEC scenarios (not just malware links) are particularly valuable.

**Email filtering and domain monitoring** — Monitor for newly registered domains similar to yours. Configure email gateways to flag external emails that use internal display names.

Yrzo AI checks your email authentication records (SPF, DKIM, DMARC), web application authentication controls, and information disclosure as part of 75+ automated security checks. Starting from £149 at yrzoai.dev.