Business email compromise: how the “urgent invoice” scam works
BEC rarely contains a link or attachment. Here is how it unfolds, and the one control that stops most of it.
· Social Engineering
Business email compromise (BEC) is the quiet, expensive cousin of phishing. There's often no malicious link and no attachment, just a believable request to move money.
A typical sequence
- Reconnaissance. The attacker learns who approves payments and which suppliers you use, often from public sources.
- The approach. An email arrives from a lookalike domain, or from a real supplier mailbox that has been taken over.
- The change. "We've moved banks. Please use the new details below for this and future payments."
- The pressure. "This must go out today or we'll pause your account."
Because the email may come from a genuine account, technical filters often let it through.
The control that matters most
Verify any change to payment details out of band: call the supplier on a number you already had on file, not one in the email. Make that a written rule, and make it normal for staff to say "I'll just call to confirm."
Other helpful habits
- Treat new urgency on routine payments as a warning sign, not a reason to hurry.
- Watch for small domain changes such as an extra letter, a swapped character, or a different ending.
- Require a second approver for new or changed payees.
Training helps people recognise the pattern, but the process is what catches the attempt that looks perfect.