Hacker Hub - November 2026

How Business Email Compromise Works and How to Stop It

Picture the scene. You get an email that looks completely normal from a supplier you've paid for years, in the same thread as last month's invoice. The only difference is a short note saying their bank details have changed.

Business email compromise (BEC) is one of the simplest and most expensive scams aimed at small businesses. There's no clever malware involved. Just patience, a mailbox and a busy finance team.

What is business email compromise?

BEC is when a criminal uses a real or a convincing fake email account to trick someone into sending money or sensitive information. They might pretend to be a supplier, a customer or a director.

It works because it doesn't look like an attack. There's no dodgy link or strange attachment for your security tools to catch, it just looks like day-to-day business.

How does an attack actually unfold?

Every case differs, but a typical one goes like this.

First, the attacker gets into someone's email account, often through a phishing email or a reused password. It might be yours, or it might be your supplier's.

Next, they wait. They read the inbox for days or weeks, learning who pays whom, how invoices are worded and when payments are due. They sometimes set up a hidden rule so replies never reach the real owner.

Then they strike at the right moment. They join an existing conversation about a genuine invoice and politely explain that the bank account has changed. The tone, the signature and the timing all match.

Finally, the payment goes out to the criminal's account. The fraud usually only comes to light weeks later, when the real supplier asks why they haven't been paid.

Why do small businesses fall for it?

It’s not because staff are careless. BEC succeeds where processes are informal. One person can change supplier details, approve a payment and send it without anyone else looking. Requests that feel urgent or come from someone senior get done quickly, and that is exactly what the criminal is counting on.

Smaller firms also tend to rely on email for almost everything, including things that really ought to be checked another way.

What are the warning signs?

Look at how a request is made, not just what it says. Be cautious if the email pushes unusual urgency or secrecy, or if the sender's address differs from the real one by a single letter.

A new bank account, especially in a different country, deserves a second look. So does anyone who avoids a quick phone call to confirm the details.

How can you stop it?

Turn on multi-factor authentication for every email account. It blocks most account takeovers, even when a password has leaked.

Verify any change of bank details by phone, using a number you already hold. Never use the number in the email.

Require a second person to approve new payees and changes to existing ones.

Check for hidden email forwarding rules, which attackers use to stay unnoticed.

Agree as a team that urgency is a warning sign, not a reason to skip the checks. Make it normal to say "let me double check that."

None of these needs expensive tools. They need agreement and consistency. Write them down, share them with everyone who handles payments, and review them regularly so they don't slip.

What should you do if it happens?

Speed matters. Call your bank straight away and ask them to try to recall the payment. The sooner they know, the better the chance of recovering something.

Then tell your IT provider, change passwords on the affected accounts, check for hidden forwarding rules and warn the other party, because their email may be compromised too. Finally, report it to the police fraud reporting service.

FAQs

What is business email compromise in simple terms?

It's a scam where a criminal uses email to pose as someone you trust, such as a supplier or director, and tricks you into sending money or information. It relies on trust and timing rather than technical tricks.

Can antivirus or spam filters stop BEC?

Rarely. The emails often contain no links or attachments, so there is little for those tools to flag. Process checks and multi-factor authentication are far more effective.

Can you get money back after a BEC payment?

Sometimes, but only if you act quickly. Contact your bank immediately so they can attempt to recall or freeze the payment.

Who is most at risk from business email compromise?

Anyone who handles payments or supplier details, particularly finance staff and directors. Small firms are often targeted because their approval processes are less formal.

Next steps

Not sure how well your payment and email processes would hold up? Vorago Security can review your set-up and show you where the gaps are, in plain English and with no pressure.