Also known as: BEC · CEO fraud · invoice fraud
Business email compromise (BEC) is a fraud in which an attacker impersonates or hijacks a trusted business email account to induce fraudulent payments or data disclosure, typically without deploying any malware.
BEC consistently produces some of the highest financial losses of any attack category, frequently exceeding ransomware totals, despite involving no technical exploitation at all. A convincing email requesting a change of bank details on a legitimate invoice is often the entire attack.
Because there is no malware, endpoint detection is blind to it. Defence rests almost entirely on process: out-of-band verification of payment detail changes, dual approval for transfers above a threshold, and treating urgency in financial requests as a signal to slow down rather than speed up.
Phishing
Phishing is a social-engineering attack in which an adversary impersonates a trusted party — typically via email, SMS, or a cloned website — to trick a victim into revealing credentials, authorising a payment, or installing malware.
Social Engineering
Social engineering is the manipulation of people into performing actions or disclosing information that compromises security, exploiting trust, authority, urgency, or helpfulness rather than technical vulnerabilities.
Multi-Factor Authentication
Multi-factor authentication (MFA) requires two or more independent categories of evidence to verify identity — typically something you know, something you have, and something you are — so that a stolen password alone is insufficient to gain access.
Incident Response
Incident response is the structured process an organisation follows to detect, contain, eradicate, and recover from a security incident, and to learn from it afterwards.