Business email compromise (BEC) is when an attacker takes over or imitates a real email account to redirect a payment or steal data. It is expensive because your own people approve the payment, against a real invoice, at a believable moment. The fix is to lock down mailbox access and to have a written process for changing supplier bank details.

Business email compromise is when an attacker takes over or imitates a real email account to trick someone into sending money, or sensitive data, to the wrong place. The attacker either takes over a genuine account or uses a spoofed or lookalike domain, and some attacks use both. This post focuses on mailbox takeover, which is what the controls below are built around.

In a mailbox takeover, nothing is forged. The email comes from a real address, in a real thread, about a real invoice. That is why it is so hard to catch. Our previous blog looked at social engineering as the route in. This one covers what happens once they are in.

How does a business email compromise attack work?

Business email compromise starts with research. The attacker learns about the business from public sources: who works there, who approves payments, and who the suppliers are. They then take one of two routes, and some attacks combine them.

Mailbox takeover has four steps:

1. The attacker gets a working login for a real mailbox, for example through a fake sign-in page or a reused password.
2. They read the mail quietly, sometimes for weeks, to learn who pays whom and when.
3. When a real invoice is due, they join the thread, or send from the account, with new bank details.
4. Your own staff pay the invoice into the attacker’s account.

In a mailbox takeover, no malware is involved and no email is forged. Every message comes from a genuine address in a genuine conversation, which is why filters and a quick glance both miss it. 

A spoofed or lookalike domain needs no login. The attacker registers a domain that looks almost the same as yours or a supplier’s, then emails a payment request from it with new bank details, aimed at someone who approves payments.

Why is business email compromise so expensive?

Business email compromise is expensive because it removes the checks that normally protect a payment. Three things drive the cost:

• Your own people authorise it. The payment goes through your normal approval process, so nothing looks like fraud to the finance team.
• It matches a real invoice. The supplier, the amount and the timing are all correct. Only the bank details have changed.
• The money is hard to get back. Payments are often moved on quickly, so recovery depends on telling your bank straight away.

UK Finance, the banking industry body, recorded £41.3 million lost to invoice and mandate scams in 2025, the category that covers payments redirected to a criminal’s account. £28 million of that came from business accounts, and 48% of the total was returned to victims, so more than half was not: UK Finance Annual Fraud Report 2026.

The payment is not the only cost. There is also staff time, forensic investigation and professional fees. If personal data sat in the compromised mailbox, there may be notification duties as well.

Who do attackers target, and what do they want?

Attackers target the people who can approve payments or access sensitive data. That includes executives, finance staff and HR, but any member of staff with a mailbox can be the way in.

They want one of two things:

• Money. A payment redirected to an account they control.
• Sensitive data. Employee, payroll or customer information, often requested from HR or finance by someone who appears to be a senior colleague.

The people on the receiving end are not only your own staff. Attackers also target customers, suppliers and partners, using your mailbox or your name.

UK Finance’s 2026 fraud report describes both methods: criminals either compromise an email account or intercept emails, and in CEO fraud they either access the company’s email system or spoof it: UK Finance Annual Fraud Report 2026.

How is business email compromise different from phishing?

Phishing is the broad tactic of tricking someone with a message. Business email compromise is a specific fraud, carried out from a taken-over mailbox or a lookalike domain, to redirect a payment or steal data. 

How does an attacker get into a mailbox?

An attacker does not need clever software to get into a mailbox. Three routes in are:

• A phishing email that sends a member of staff to a fake Microsoft 365 sign-in page.
• A password reused from another site that has already been breached.
• An account with no multi-factor authentication (MFA), often a shared mailbox or an old administrator account.

What stops an attacker getting into a mailbox?

Four controls do most of the work:

• MFA on every account, including administrators and shared mailboxes. Use number matching as a minimum, and passkeys or security keys for finance staff and administrators.
• Conditional access, which challenges or blocks a login from an unexpected place or device.
• Legacy authentication switched off. Older mail protocols can’t ask for MFA, so leaving them on gives an attacker a way round it.
• Unique passwords through a password manager, so a breach on another site doesn’t open your mailbox.

Administrators should also use a separate account for admin work, not the one they use for everyday email.

How can you tell if an attacker is in a mailbox? 

Attackers rarely announce themselves, so the signs are small and sit in the mailbox settings as well as in the emails. Look for:

• New inbox rules, especially ones that move or delete messages containing words like “invoice” or “payment”.
• Forwarding set up to an outside address.
• Sign-ins from countries or devices the user has never used.
• Sent items or read messages the user does not recognise.

In Microsoft 365, inbox rules and forwarding settings are visible in the Exchange admin centre, and sign-in history is in Microsoft Entra ID. No one can check these by hand across a whole company every day. They need alerting on new mailbox rules and forwarding changes, watched by someone who will act on it, ideally around the clock.

What does a locked supplier bank-details process involve?

It means no bank detail changes on the strength of an email alone. That holds whichever route the attacker uses, because the check never depends on trusting the email. A workable version has four parts:

1. Verify once, out of band. When a supplier first goes on your system, or later changes details, confirm by phone on a number you already hold, not one in the email asking for the change.
2. Lock it. Once verified, the details are held in your finance system and cannot be edited casually.
3. Change-control it. Any change request goes through the same call-back, logged with who made the call, when, and who approved it.
4. Dual authorisation. Payments above an agreed threshold, and any payment to newly changed details, need a second approver.

Write it down. If the process lives in one person’s head, it will not survive a busy Friday afternoon or a new starter. A written process also gives you evidence if you ever need to show a bank or insurer that you had controls in place.

What should we do if a payment has already gone?

 Contact your bank straight away and report it to Action Fraud. The sooner the bank hears about it, the better the chance of recovering anything. 

Does cyber insurance cover business email compromise? 

Cyber insurance covers business email compromise only if the policy says so. Some policies include funds transfer fraud as an extension, usually with a lower limit than the main policy. Others exclude it, or pay only if you can show specific controls were in place. An insurer can decline or reduce a claim if the controls you declared were not running. Check how your policy treats payment diversion fraud, and ask your broker directly.

*This post is not insurance advice, and we cannot tell you what your policy covers.

What should we check first?

You do not need technical knowledge to test your exposure. Three of the twelve questions in our guide map directly to this problem:

• Question 1: Is MFA enforced on every account, including administrators and shared mailboxes?
• Question 5: Are SPF, DKIM and DMARC configured and enforcing on every domain we send from?
• Question 6: What is our process for a supplier changing bank details, and is it written down?

If the answer to any of these is “I think so”, treat it as a gap.

FAQ

What is business email compromise?
It is a fraud in which an attacker uses access to a real email account to trick someone into paying money to the wrong bank account.

How is it different from phishing?
Phishing is usually how the attacker gets the password. Business email compromise is what they do with it afterwards.

What is the best defence against business email compromise?
MFA on every account, alerting on new mailbox rules and forwarding, and a written, call-back-based process for any change of bank details.

Can stolen funds be recovered?
Sometimes, but speed matters. Contact your bank immediately and report the fraud to Action Fraud.

Does cyber insurance cover payment diversion fraud?
It depends on the policy. Check the wording with your broker.