Scope
Business Email Compromise (BEC) is the single costliest attack vector for small businesses. Unlike ransomware, which destroys data, BEC directly steals money—sometimes hundreds of thousands of dollars—in a single wire transfer.
The FBI reports that BEC attacks cost US organizations $2.9 billion in 2023, with an average loss of $145,000 per incident. Small businesses, with smaller IT teams and less formal approval processes, are disproportionately targeted because attackers know that decision-making is faster and verification is weaker.
This article covers how BEC works, the four attack variants that account for most SMB losses, why small businesses are prime targets, the exact technical and process controls that stop BEC before money leaves, how to detect an attack in progress, what to do if you've been compromised, and why untested email security is a liability in cyber insurance claims.
What is Business Email Compromise?
Business Email Compromise is a targeted attack in which an attacker impersonates a trusted sender (a company executive, business partner, vendor, or attorney) via email, then tricks an employee into sending money, transferring sensitive data, or changing system configurations.
The attack succeeds because it exploits trust, creates urgency, and bypasses most email security controls. Unlike phishing (which relies on malicious links or attachments), BEC uses legitimate email infrastructure and social engineering. The attacker doesn't need to breach your email server—they just need to craft a convincing message that lands in the right inbox at the right moment.
The attack chain is simple: Research target → Identify decision-maker and financial approver → Compromise or spoof the sender's email → Send urgent request → Wait for wire transfer or data exfiltration → Disappear before anyone realizes what happened.
The Four Types of BEC That Cost SMBs the Most
1. CEO Fraud (Impersonation)
An attacker impersonates the CEO or CFO and sends an urgent email to a finance employee requesting an immediate wire transfer. The request is marked confidential and urgent, with instructions not to tell anyone.
Scenario: "This is our CEO. We're in the middle of a confidential acquisition and need a wire transfer of $250,000 to a new vendor account. Wire this immediately and confirm when done. Do not discuss with anyone."
Why it works: Employees trust their CEO, the request seems legitimate, the urgency prevents verification, and the secrecy instruction discourages double-checking.
2. Vendor Impersonation & Invoice Fraud
An attacker spoofs a trusted vendor's email and sends a fake invoice requesting payment to a new bank account. The invoice looks legitimate and is often timed to coincide with a real purchasing cycle.
Scenario: An attacker spoofs your office supply vendor and sends an invoice that looks identical to real invoices you receive—same logo, same format, same amount range. The only change is the payment instructions point to the attacker's account instead of the vendor's.
Why it works: Employees process invoices routinely without verification, the email appears to come from a trusted vendor, and the amount is consistent with normal purchasing.
3. Attorney/Legal Impersonation (Data Exfiltration)
An attacker impersonates a lawyer or legal firm and requests urgent confidential data—employee records, customer lists, financial statements, or proprietary information—claiming it's needed for litigation, due diligence, or legal review.
Scenario: "We represent the company in ongoing litigation and need immediate access to customer contact lists and billing records for discovery. Send via secure file transfer. This is confidential."
Why it works: Legal requests carry authority and urgency, employees fear non-compliance with legal demands, and the confidentiality instruction prevents verification with management.
4. Payroll Diversion & W-2 Fraud
An attacker impersonates HR or payroll and requests that an employee's direct deposit be changed to a new bank account, or requests tax/payroll data (W-2s, salary information) for all employees.
Scenario: "Employee is being transferred to a new office. Update their direct deposit to [attacker's account]. Process immediately so no pay disruption occurs."
Why it works: HR requests are common and routine, the urgency prevents verification, and changing direct deposit is a simple admin task.
Why Small Businesses Are Targets
Small businesses are disproportionately targeted for BEC because:
- Fewer approvers: Larger enterprises have multiple layers of approval for wire transfers. SMBs often have a single decision-maker who can authorize large payments quickly.
- Weaker email security: Many SMBs don't implement DMARC, SPF, or DKIM authentication, making email spoofing trivial.
- Less formal verification: Larger organizations have formal call-back procedures for payment requests. SMBs often skip verification to move fast.
- Public leadership profiles: SMB owners and executives are often visible on LinkedIn, company websites, and local business directories, making research easy.
- LinkedIn reconnaissance: Attackers use LinkedIn to identify organizational structure, chain of command, and employee names—everything needed to craft a convincing email.
- Fewer IT resources: SMBs don't have dedicated security teams to monitor email anomalies or respond quickly.
Prevention: Technical Controls That Actually Work
Email Authentication (DMARC, SPF, DKIM)
This is your most important defense. Email authentication makes it impossible for attackers to spoof your domain or trusted vendor domains.
- SPF (Sender Policy Framework): Tells email servers which IPs are authorized to send email from your domain. Takes 15 minutes to set up.
- DKIM (DomainKeys Identified Mail): Digitally signs outgoing email so receivers can verify it came from your domain. Most email providers set this up automatically.
- DMARC (Domain-based Message Authentication, Reporting, and Conformance): Combines SPF and DKIM, then tells receiving servers what to do with failed emails (reject, quarantine, or monitor). This is the linchpin—set DMARC policy to "reject" for your domain.
Action: Contact your email provider and ask them to enable DMARC with a "reject" policy for your domain. It takes one conversation. Most email providers (Microsoft 365, Google Workspace, etc.) provide templates to make this easy.
Email Filtering & Anomaly Detection
Deploy an email gateway that watches for:
- Emails from external senders that claim to be from your domain (impersonation attempts)
- Slight variations in sender addresses (e.g., "ceo@companyname.co" vs. "ceo@companyname.com")
- External emails that request wire transfers, payment changes, or sensitive data
- Emails with urgent language combined with secrecy instructions ("don't tell anyone")
- Unusual attachment types or suspicious links
Tools like Proofpoint, Mimecast, or even the advanced threat protection built into Microsoft 365 and Google Workspace can catch many BEC attempts automatically.
User Training (Real Scenarios, Not Generic Videos)
Generic security awareness training doesn't work for BEC because employees encounter fake CEO emails and vendor invoices that look legitimate. Instead, train on:
- CEO fraud recognition: Real CEOs don't send payment requests via email from their personal device. If an email asks to keep something confidential, verify it by calling the sender's known phone number.
- Vendor verification: Always verify payment instructions by calling the vendor directly (not replying to the email). Use a phone number from the vendor's website, not from the email.
- Legal requests: Verify legal requests by calling the attorney or law firm directly before sharing any data. Real attorneys expect verification.
- Unusual requests: Direct deposit changes, bulk data requests, and payment instructions to new accounts should trigger verification.
Test your team monthly: Send fake BEC emails and see who falls for them. This is more effective than any video training. Track metrics and coach failing teams.
Approval Workflows & Call-Back Verification
Implement a formal process for large payments:
- Wire transfers over a threshold ($5,000 for SMBs, adjust based on your business) require a phone call to verify with the requestor before the wire is sent.
- The call must use a known phone number—not a number from the email requesting the transfer.
- The approver should ask specific questions: "Which vendor is this for?", "Is this a new account?", "What's the project code?" Use your knowledge of the business to catch impersonations.
- Document all wire transfers: who requested, who approved, what was verified.
Separate Finance & Executive Mailboxes
Consider using separate email addresses for financial approvals vs. day-to-day communication. This makes it harder for attackers to research and target your finance workflow. For example, payments@yourcompany.com instead of the CFO's primary email.
Detection: Spotting an Attack in Progress
BEC attacks often leave traces before the wire transfer completes. Watch for:
- Unusual sender addresses: A CEO email that comes from a Gmail account instead of the company domain, or an email address that's off by one letter.
- Tone changes: A CEO who usually signs emails professionally suddenly using urgency and unusual language.
- Timing anomalies: A payment request from a vendor at 11 PM when you normally receive requests during business hours.
- Instructions to hide the request: Any email that says "don't tell anyone" or "keep this confidential" is a red flag. Real business doesn't work this way.
- New payment accounts: A vendor suddenly requesting payment to a new account instead of their established one.
- Outside of normal process: A payment request that bypasses your usual approval workflow (going to one person instead of the normal two-person approval).
If you spot these signs: Don't reply to the email. Call the sender directly using a known phone number. Confirm the request is legitimate before proceeding.
Response: What to Do If You've Been Compromised
If a wire transfer was sent as a result of BEC:
- Contact your bank immediately. Most banks can reverse wire transfers if notified within hours. Don't wait.
- Provide a detailed timeline: When was the email received? When was the wire sent? How much was transferred?
- Request the bank to trace the receiving account. Banks can sometimes recover funds if the receiving account is also in the US.
- File a complaint with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. Include all email headers and transaction details.
- Report to local law enforcement. While they may not investigate small amounts, the report creates an official record.
- Notify your cyber insurance carrier immediately. BEC losses are often covered, but only if reported within required timeframes. Delays in reporting may void coverage.
- Reset compromised email accounts and credentials. If an employee's email was compromised, or if internal credentials were used, reset passwords and enable MFA.
- Review email logs for other suspicious activity. One BEC attack often signals that your email security has other weaknesses.
BEC and Cyber Insurance
Many cyber insurance policies cover BEC losses, but only if you've implemented baseline email security controls. Policies often require:
- DMARC configured with a "reject" policy
- Email filtering or gateway in place
- Multi-factor authentication on email accounts
- Documented approval processes for wire transfers
- Evidence that employees have received BEC training
Without these controls, insurers may deny your claim even if you were attacked. This is similar to denying a homeowner's fire insurance claim if they ignored fire code violations.
Additionally, if you pay a ransom via wire transfer induced by BEC (e.g., an attacker threatens to release data unless you pay), that payment is unlikely to be covered because you transferred money under false pretenses, not due to encryption or system failure.
BEC and CSFSafe Essentials
CSFSafe Essentials includes a complete email security checklist covering:
- Step-by-step DMARC/SPF/DKIM configuration
- Email filtering vendor selection guide
- BEC training materials and monthly simulations
- Wire transfer approval workflow templates
- Incident response procedures for BEC attacks
- Vendor verification checklist
The Essentials also cross-references cyber insurance requirements so you know exactly which controls matter for your policy coverage.
What to Do Now
- This week: Contact your email provider and request DMARC configuration with a "reject" policy. Takes one conversation. Most providers have templates.
- This week: Confirm your organization has a call-back verification process for wire transfers over $5,000. Document it.
- Next week: Run a fake BEC email simulation with your team. Impersonate a vendor or CEO and send a payment request to 10% of staff. See who falls for it. Coach those who do.
- Next 30 days: Deploy email filtering with anomaly detection (external emails claiming to be from your domain, urgency + secrecy language). Most platforms offer this built-in.
- Next 30 days: Review your cyber insurance policy. Confirm you meet all email security requirements. If you don't, implement controls before renewal.