What Is Business Email Compromise? A Plain Guide for UK Businesses

Business email compromise (BEC) is a fraud in which a criminal uses a real or faked email account to trick someone at your company into sending money or sensitive data. The usual goal is a payment to the wrong bank account. It needs no malware and often no technical skill, which is why it keeps working.

The National Crime Agency’s payment diversion campaign reported 4,600 cases to Action Fraud in the year to September 2021, with average individual losses of around £30,000. That figure is a few years old, but the method has not changed. The NCA also noted spikes in March and November, around financial year-ends. If you are reading this in November, you are in one of the busy months.

What is business email compromise?

BEC is a type of payment diversion fraud, sometimes called mandate fraud. The attacker pretends to be someone you trust, such as a supplier, a director, a solicitor or a customer. Then they ask for money, or for a change to the bank details you already hold.

The FBI describes it as a scam aimed at businesses and individuals who make legitimate fund transfer requests. Its public warning from June 2023 lists four common forms:

• Fraudulent payment requests, where the sender is impersonated.
• Requests for staff data, such as tax forms, which may involve no payment at all.
• Payments diverted to cryptocurrency wallets or exchanges.
• Property deals, where the buyer is told to pay a different account.

The same FBI body, the Internet Crime Complaint Center, logged 21,442 BEC complaints in 2024, with reported losses of $2,770,151,146 (about $2.77 billion). Those are US figures, but the same tactics are used against UK firms.

How does a BEC attack actually work?

Most attacks follow one of two routes. Knowing which one you face changes how you defend against it.

Route one: spoofing and lookalike domains

The attacker never gets into your systems. Instead, they send an email that looks like it came from your managing director or a regular supplier. It may use a domain that differs by one letter, or a display name that matches a real person. On a phone, you often see only the display name.

The NCSC advises organisations to set up SPF, DKIM and DMARC on their own domains, so attackers cannot spoof them easily. It also asks you to encourage the people you deal with to do the same. This stops direct spoofing of your domain. It does not stop a lookalike domain, so you still need a human check.

Route two: a hijacked mailbox

Here the attacker has stolen a real login, usually through phishing. They read the mailbox for days or weeks. They learn who pays whom, when invoices land and how people write to each other. Then they step into a live conversation and “update” the bank details.

This version is far harder to spot because the email really does come from the right account. The NCSC’s small organisations guidance notes that access to one inbox can open up other systems and sensitive information, including banking details. Attackers can also use the account to reset passwords elsewhere.

What are the warning signs of a BEC email?

The NCA’s campaign lists several red flags. Treat any one of them as a reason to pause:

• An urgent request to process a large or unusual payment.
• A request to change an existing supplier’s bank details, or to set up a new supplier.
• Wording that differs from the genuine sender’s usual style.
• Spelling mistakes in the message or in the email address.

Add two more from experience. Pressure to keep the request quiet is one. A sender who cannot be reached by phone “because they are travelling” is another. Neither is proof, but both appear often in real cases.

Who gets targeted by business email compromise?

Finance teams are the obvious target, but they are not the only one. Attackers also go after executive assistants, who know the diary and the approval chain. HR teams get hit for staff data. Smaller firms are attractive because there is often one person who can approve a payment and no second check.

The NCA also points out that criminals choose specific victims, which is why individual losses can run much higher than in many other frauds. A single successful invoice swap can wipe out a month of margin for a small business.

How can you prevent business email compromise?

No single control stops business email compromise. The NCSC’s phishing guidance describes four layers, and they map well onto this problem.

Make it hard for attackers to reach your people

• Publish SPF, DKIM and DMARC records for your domains, and move DMARC towards a quarantine or reject policy.
• Filter spam and phishing on the mail server for every user by default.
• Limit what staff details appear on your website and social media, especially for senior people.

Give staff a safe way to check

This is the control that beats most BEC attempts. Any request to pay a new account, or change an existing one, gets confirmed through a second channel. Call the supplier on a number you already hold, not one in the email. The NCSC calls this out-of-band verification, and the NCA gives the same advice.

Make it a written rule that applies to everyone, including the boss. If a director can waive the check by sending an angry email, attackers will write angry emails.

The NCSC also warns against relying on phishing simulations alone. It recommends extra support for high-risk roles, such as finance, and a simple way to report suspicious mail without blame. If you do run simulations, see our guide to phishing simulation testing for what they can and cannot tell you.

Limit the damage if someone is fooled

• Turn on multi-factor authentication (the NCSC calls it 2-step verification) for every account, and use passkeys for staff accounts where your provider supports them.
• Remove access for leavers and unused accounts, and keep admin rights to a minimum.
• Keep logs and monitor for odd behaviour, such as new forwarding rules on a mailbox.

Not all MFA is equal. Some phishing kits capture the session after the user has approved the prompt. Our article on what multi-factor authentication stops and what still gets through explains the gaps.

Be ready to respond

Have a plan before you need it. Decide who calls the bank, who resets passwords and who reports the incident. The NCSC suggests practising the plan, for example with its Exercise in a Box.

What should you do if you have been targeted?

Speed matters most. The NCA’s advice is to report to your bank and to Action Fraud straight away. The FBI says the same about its own victims: “time is of the essence” when asking a bank to recall a transfer.

1. Phone your bank and ask for a payment recall. Do this first.
2. Report to Action Fraud on 0300 1234 2040 (in Scotland, call 101).
3. Reset the passwords on the affected mailbox and check it for forwarding rules you did not create.
4. Tell the other party, using a trusted phone number, that their details may be compromised.
5. Check whether personal data was exposed. If it was, you may need to report to the ICO within 72 hours.

How do you test whether your business would fall for it?

Policies against business email compromise look fine on paper. The real question is whether a busy person at 4.45pm on a Friday follows them. You can test that. A social engineering assessment sends realistic phishing and pretext attempts to your staff, with your agreement, and shows where the process breaks. Our guide to social engineering penetration testing covers what that involves.

If you would like a scoped test of your people and your email controls, the Aardwolf team is happy to talk through what would suit your size of business. The advice above works with or without us.

Frequently asked questions

Is business email compromise the same as phishing?

No, but they are linked. Phishing is the method of tricking someone into clicking or sharing a login. BEC is the fraud that often follows. Some BEC attacks skip phishing completely and rely on a spoofed address.

Is BEC the same as invoice fraud or mandate fraud?

Mostly, yes. The NCA treats payment diversion fraud, BEC and mandate fraud as names for the same family of scams.

Can email filters block business email compromise?

They help, but they miss a lot. A business email compromise message often has no link or attachment, so there is nothing for a filter to flag. A hijacked mailbox also passes every authentication check. That is why a payment verification process matters more than any tool.

Will cyber insurance cover a BEC loss?

It depends on the policy. Some cover funds transferred by deception and some exclude it or cap it. Read the wording, and ask your broker whether payment verification is a condition of cover.

How often should we train staff on this?

Short, regular sessions beat one long annual course. Focus on the people who handle payments and supplier details, and keep a no-blame reporting route open.