What is Business Email Compromise? How BEC Attacks Work and How to Prevent Them

What is Business Email Compromise and How Does It Work?

BEC is an attack that takes advantage of trust rather than relying only on technical vulnerabilities. The attacker wants the recipient to believe a legitimate business request has come from someone they already know.

Depending on the target, the attacker may pretend to be:

• A CEO or finance executive asking for a payment
• A supplier requesting a change to bank details
• A customer asking for confidential information
• An employee whose mailbox has already been compromised

Before sending the message, attackers may research company websites, employee roles, suppliers, public profiles, and previous communication patterns. They are often looking for people who can authorize payments or access valuable information.

This type of scam can take several forms, including executive impersonation, supplier fraud, payroll diversion, compromised accounts, and requests for confidential data.

A compromised Microsoft 365 account creates an even more convincing situation. The attacker may be able to send messages from a legitimate mailbox and continue existing email conversations. Effective BEC protection therefore needs to address both fake senders and genuine accounts that have been taken over.

Why Can BEC Emails Get Through Traditional Email Security?

Traditional email security is good at finding obvious threats. Malware, malicious links, suspicious attachments, and known bad senders give security systems something concrete to analyze.

BEC messages often do not provide those signals.

An email may be only a short message requesting something that seems appropriate for the reader. At first sight, everything in the email seems harmless. Nonetheless, when the time, sender, receiver, and request are considered, things get complicated.

Email authentication is still important, but it has limits. However, it does have its purpose.

SPF determines whether the sending server is allowed to send emails for a certain domain, DKIM verifies the email signature, and DMARC explains to the receiver how to act on failed emails. Microsoft 365 also uses spoof intelligence and other sender-related signals.

These measures make sender spoofing more difficult, but preventing BEC attacks requires more than sender checks. They do not guarantee that the person making the request is genuine.

One example is registering a domain like a legitimate one and setting the necessary records (SPF, DKIM, DMARC). The message can pass authentication and still be an impersonation attempt.

That difference between spoofing and impersonation is important. Spoofing involves falsifying the apparent sender. Impersonation is about making the recipient believe that the sender is a person or organization they already know.

For that reason, preventing BEC attacks needs more than domain authentication. It also needs controls that understand identities, relationships, and communication patterns.

What Is BEC Protection in Microsoft 365?

Exchange Online and Microsoft Defender for Office 365 contribute different layers of protection within Microsoft 365.

Exchange Online provides the baseline security for cloud mailboxes. This includes built-in protection against spoofing and phishing, along with spoof intelligence and controls that consider authentication and sender signals. SPF, DKIM, and DMARC add another layer by protecting the organization’s sending domains.

Defender for Office 365 goes further with controls designed for more targeted phishing and impersonation attempts.

Administrators can create anti-phishing policies that focus on specific users and domains.

For example, an organization may want more protection around executives, finance teams, procurement staff, or important suppliers. When an incoming message appears to impersonate one of these identities, Defender can apply additional detection and protection.

Mailbox intelligence provides another useful signal. It uses communication patterns and contact history when evaluating potential impersonation. That matters in BEC because attackers often try to imitate people with whom the recipient already communicates.

For a BEC-focused security review, organizations should pay particular attention to:

• User impersonation protection
• Domain impersonation protection
• Mailbox intelligence
• Spoof intelligence
• Anti-phishing policies and configured actions
• Identity and access controls

Simply having Defender enabled does not mean the environment is properly configured for the organization’s specific risks. The relevant users, domains, suppliers, and mail-flow patterns all need to be considered.

Is Your Exchange Environment Protected Against BEC? Get expert help configuring Exchange, Defender, identity controls, and email security policies around your business risks.

Contact our BEC Expert

What are the right BEC prevention strategies?

Preventing BEC attacks takes more than adding another email filter. Email security, identity protection, monitoring, and business verification all have a role to play.

Start with SPF, DKIM, and DMARC. Review the domains that send email for the organization, including legitimate third-party services. If authentication records do not cover the full mail environment, attackers may find opportunities to exploit that gap.

Next, identify the people and domains that need stronger impersonation protection. Executives are obvious targets, but finance, procurement, payroll, and supplier-facing employees can also receive high-risk requests.

Identity security is equally important. MFA makes stolen credentials harder to use, while access controls can reduce what an attacker can do if an account is compromised.

It is also worth paying attention to mailbox activity. Watch your mailbox activity for signs of a hacked account. Look for forwarding rules you didn’t create, especially to outside addresses. Also check for sent emails you don’t recognize and password changes you never requested.

If you receive an email with a request to change supplier bank details, you should not do so just because the email seems legitimate. Check the veracity of the request by phone or against other details already in your company’s archives.

The same goes for payment requests sent by executives over email. Good email security can minimize risks but verifying the authenticity of the request via other communication methods.

How Can Evolvous Help Businesses with BEC Prevention?

Microsoft 365 environments can become difficult to secure when an organization has several domains, third-party email services, existing mail-flow rules, legacy settings, and different security requirements across departments.

Evolvous provides Microsoft Exchange consulting covering architecture, implementation, migration, integration, security, optimization, backup, disaster recovery, and ongoing support. Its Exchange security services also cover Microsoft Defender for Office 365, DLP, and access controls.

For BEC protection, the process can start with an assessment of the current environment. The objective is to determine whether the existing controls are correctly configured and whether they fit the organization’s Exchange architecture and mail flow.

With Evolvous, you get:

• Exchange Online architecture and mail flow
• SPF, DKIM, and DMARC configuration
• Defender anti-phishing policies
• User and domain impersonation protection
• Mailbox intelligence settings
• Identity and access controls
• Mailbox and forwarding controls
• DLP and security requirements

From there, Evolvous can help configure and optimize the relevant Microsoft technologies. The goal is not to switch on every available security feature. As threats like phishing, BEC, ransomware, and credential theft evolve, it is important to have the right mix of tools and processes to keep your data and your people protected.

Looking to strengthen your Exchange and Microsoft 365 security architecture?

Contact Evolvous to learn more.

FAQs on BEC

1. What is business email compromise?

BEC, which is described as email fraud, occurs when fraudsters impersonate well-known individuals or companies so that they can trick victims into losing money or exposing their confidential information.

2. What does effective BEC prevention involve?

It is advisable to utilize multi-factor authentication methods, SPF, DKIM, DMARC, anti-phishing software, and protection from impersonation, monitor the mailbox and inform employees for BEC prevention.

3. What is a different name used for business email compromise?

An alternative name for the above term is email account compromise (EAC), especially in cases where a criminal gets hold of a normal user’s email and exploits it for fraudulent purposes.

4. What are some identifiers of a BEC attack?

Unexpected payment requests changed bank details, unusual urgency, lookalike domains, unusual forwarding rules, and requests for sensitive information are some identifiers of BEC Attacks.

5. What is a BEC attack?

A BEC attack uses email impersonation, social engineering, or a compromised account to trick employees into making payments, sharing information, or taking another unauthorized action.