Business email compromise, or BEC, is one of the most costly types of fraud businesses face. Unlike phishing sent to thousands of people at once, BEC is targeted. Criminals research a business, work out who approves payments, and craft messages designed to look completely genuine.

There's often no malware and no obvious hacking. The fraud works because someone trusted is persuaded to approve a payment or share sensitive information — which is why BEC is often called a fraud of trust rather than a fraud of technology.

It can happen to a business of any size. Larger organisations are attractive because of higher transaction values, but smaller businesses are often targeted precisely because they have fewer formal checks in place.

How it works

The fraud usually starts long before any payment request appears. Criminals gather information from public websites, social media, company announcements, supplier relationships and org charts, building a picture of how payments are approved and by whom.

They then create a convincing email address, compromise a real mailbox, or impersonate someone already involved in a genuine transaction. Because the email looks like part of everyday business, the payment request often goes through without a second look.

Some attacks use fake invoices. Others ask for a supplier's bank details to be changed. In more sophisticated cases, fraudsters read real email threads for weeks before stepping in at the most convincing moment.

What this can look like

A finance team is expecting an invoice from a regular supplier. A few days before it's due, an email arrives saying the supplier has changed its banking details. The timing feels right, the wording feels familiar, and the request seems reasonable — so the payment goes ahead.

Weeks later, the real supplier gets in touch asking why their invoice hasn't been paid. That's when the business discovers the money went to a criminal instead. The fraud worked because it blended seamlessly into a normal business process.

Why this scam works

BEC succeeds because of human behaviour, not technology. Fraudsters exploit trust, routine and urgency — when a request fits a familiar pattern, it naturally feels lower risk.

Staff aren't being careless. They're processing what looks like an ordinary transaction, because that's exactly what the fraudster wants it to look like.

Protecting your business

The strongest defence is independent verification. Never change payment instructions based on information in an email alone — confirm any change using contact details you already hold on file, not the details given in the request itself.

Other controls that help:

• Dual approval for payments
• Segregation of duties
• Payment thresholds
• Supplier verification procedures
• Fraud-awareness training
• An escalation process for unusual requests

Fraud prevention works best when these controls work together, not alone.

Key takeaway

A payment request can look completely legitimate and still be fraudulent. Trust should never replace verification.