Business Email Compromise: How Attacks Work and How to Defend Against Them
Summary
An educational guide explains how BEC uses impersonation or compromised email to divert payments and steal information, outlines common scams and warning signs, and recommends prevention and response steps.
Key points
- BEC attackers impersonate trusted contacts or take over email accounts to trick people into sending money or sensitive information.
- Common scams include altered invoices, executive impersonation, payroll diversion, gift-card requests, and fake account-security messages.
- Attackers may use generative AI to create convincing emails and voice cloning or deepfakes to support impersonation.
- Warning signs include urgent or unusual requests, unfamiliar sender addresses, and requests to change payment details or share credentials.
- The article recommends security awareness training, MFA, and confirming payment changes through a known, separate contact channel.
- MFA can make account takeover harder but may not stop AiTM attacks that steal session tokens or scams using spoofed addresses.
- After a suspected compromise, revoke sessions, reset credentials, remove suspicious inbox rules and app access, investigate account activity, and promptly contact the bank if money was sent.
Article Details
- Topic
- Business email compromise (BEC)
MITRE ATT&CK
T1078 · Valid AccountsAttackers may take over email accounts and use the compromised accounts to conduct BEC.T1114.003 · Email Forwarding RuleThe article describes attackers creating email rules to hide, delete, or forward messages.T1534 · Internal SpearphishingCompromised mailboxes may be used to phish coworkers and business partners.T1557 · Adversary-in-the-MiddleThe article describes adversary-in-the-middle attacks used to capture credentials and session tokens.T1566 · PhishingBEC uses phishing emails to trick recipients into sharing credentials, transferring money, or taking other actions.T1589 · Gather Victim Identity InformationThe article describes attackers researching targets’ names, roles, and organizational relationships.T1656 · ImpersonationAttackers impersonate executives, vendors, and other trusted contacts.
People
Vendors
Products
Huntress Managed ITDRHuntress Managed ITDR detects the behaviors behind BEC, like suspicious inbox rules, logins from unusual locations, and session hijacking, and our 24/7 SOC responds before attackers can move money.Huntress Security Awareness TrainingPair it with Huntress Security Awareness Training to help employees spot the lures that get through.