The Anatomy of a Business Email Compromise Attack (And How to Stop One)

Nobody in finance expects to send money to a criminal. The request arrives in a familiar thread, from a name they trust, with the same tone and urgency as a hundred legitimate requests before it. A vendor has changed banks. An executive needs a quick transfer before a closing. A payroll contact wants new direct deposit details. Everything looks routine, and by the time anyone asks questions, the funds have passed through several accounts and are gone.

That is business email compromise, and it succeeds not because of clever code but because of patient research, believable timing, and gaps in ordinary business process. At CMIT Solutions of Austin Downtown and West, we help local companies understand how these attacks unfold so they can interrupt them early. This guide walks through the anatomy of a BEC attack step by step, shows where each stage can be stopped, and outlines the technical controls and everyday habits that make the difference. Whether you work with a team of Austin IT experts or manage technology internally, the steps below will help you protect your money and your reputation.

The Short Answer

A BEC attack unfolds in stages: research, access or impersonation, quiet observation, a perfectly timed request, rapid money movement, and cleanup. Every stage leaves openings. The most reliable defense combines strong authentication on every mailbox, email security that flags impersonation and suspicious rules, and a firm payment verification process that nobody can bypass because of urgency or rank. Technology lowers the odds, but process closes the last gap, since the final step of nearly every BEC loss is a person approving a payment.

What Is Business Email Compromise?

Business email compromise is a scam in which criminals use email, either from a hijacked real account or a convincing fake, to trick someone into sending money or sensitive data. Unlike mass phishing, which casts a wide net, BEC is targeted. Attackers study a company, choose a person with financial authority or useful access, and craft a request that fits normal workflows.

Many BEC attacks contain no malware and no suspicious attachment, which is why traditional filters often miss them. The FBI’s Internet Crime Complaint Center has consistently ranked BEC among the costliest categories of cybercrime.

Common variations include:

• Executive impersonation: A message that appears to come from the CEO or owner asking for an urgent, confidential transfer.
• Vendor email compromise: A real or spoofed supplier account announces a new bank account for future invoices.
• Payroll diversion: An “employee” asks HR to change direct deposit details to a new account.
• Real estate and legal wire fraud: Closing instructions or trust account details are altered at the last minute.
• Gift card requests: A supposed executive asks staff to buy cards and send the codes.
• Data theft: Requests for W-2s, client lists, or tax records that fuel identity theft.
• Attorney or advisor impersonation: A “lawyer” directs an urgent payment tied to a sensitive deal.

The Anatomy of a BEC Attack, Stage by Stage

Stage 1: Research and Target Selection

Attackers begin by learning who matters. They study your website, staff bios, professional networking profiles, press releases, and social media. They note who approves payments, who manages payroll, which vendors you use, and when leaders travel. Out-of-office replies, job postings, and announcements of new offices or acquisitions give them timing and context. Leaked data from unrelated breaches supplies email addresses and old passwords.

This reconnaissance powers modern social engineering attacks, which are growing harder to detect as automation improves the quality and speed of research.

Stage 2: Getting In or Faking It

Attackers follow one of two paths.

Path A: Account takeover. They gain control of a real mailbox, usually through one of these methods:

• A phishing link that leads to a fake Microsoft 365 or Google login page
• Passwords reused from earlier breaches
• Repeated multi-factor prompts until a tired user approves one
• Adversary-in-the-middle sites that steal session tokens, which can bypass some forms of MFA
• A malicious app that tricks a user into granting mailbox permissions

Attackers now use AI to write polished, error-free lures, so evolving phishing email tactics leave far fewer obvious clues than the typo-filled scams of the past. Some campaigns are persuasive enough that scams fooling employees with years of experience are now common.

Path B: Impersonation. They skip the hack and pretend to be someone else:

• Lookalike domains: A single swapped letter, or “rn” in place of “m,” in an otherwise familiar address
• Display name spoofing: A real executive’s name attached to an unrelated email address
• Reply-to manipulation: The visible sender looks right, but replies go to the attacker
• Compromised vendor accounts: A real supplier’s hijacked mailbox that sends real-looking invoices

Stage 3: Quiet Observation Inside the Mailbox

Once inside a real account, patient attackers watch. They read threads to learn tone, signature style, invoice cycles, and approval chains. Then they dig in:

• Creating inbox rules that hide replies or move certain words to obscure folders
• Forwarding copies of messages to outside addresses
• Registering their own device for authentication so they can return
• Searching for terms like “invoice,” “wire,” “ACH,” and “payment”

Misconfigured mail settings make this easier, which is why Microsoft 365 security deserves careful attention from any firm that relies on email for daily operations.

Stage 4: The Hook

The request comes at a carefully chosen moment: month-end, a holiday weekend, a closing date, or while the target is traveling. Attackers often reply inside a real conversation, a technique called thread hijacking, so the message appears in the right place with the right history. Common pressure tactics include:

• Urgency: “This must go out today”
• Secrecy: “Keep this confidential until the announcement”
• Authority: “I am boarding a flight and cannot take calls”
• Routine: “Please use the new account for all future invoices”

Real estate closings show how effective this is, since wire fraud schemes target moments when large sums move quickly and everyone is busy.

Stage 5: Money Movement

Funds land in an account controlled by the attacker or a money mule, then move onward within hours, often split across several accounts or converted to cryptocurrency. Speed is the criminal’s advantage. The faster a bank is alerted, the better the chance of freezing or recalling the transfer, and every hour of delay lowers the odds.

Stage 6: Cleanup and Repeat

Attackers delete evidence, keep their access, and often try again. A compromised mailbox is also a launchpad. Criminals use your identity and your contact list to attack customers, vendors, and partners, which damages relationships beyond the original loss.

A Hypothetical BEC Timeline

Consider a 30-person building supply distributor. This example is fictional, but each step reflects a common real-world pattern.

• Day 1: An accounts payable clerk receives a “shared document” link that opens a fake login screen. She enters her password and approves a prompt on her phone.
• Day 2: The attacker signs in, creates a rule that moves any message containing “invoice” to a hidden folder, and starts reading threads with the company’s largest supplier.
• Days 3 to 9: The attacker learns that invoices are paid on the 15th by ACH, approved by one manager.
• Day 10: A message appears in an existing thread, apparently from the supplier’s billing contact, saying the company has changed banks. New account details are attached on letterhead.
• Day 15: The manager approves the invoice without calling the supplier because the email came inside a familiar thread. The payment goes to the attacker.
• Day 22: The real supplier asks why the invoice is unpaid. The scam is discovered, but the funds are long gone.

Any one of several controls could have interrupted this story: enforced phishing-resistant sign-in, alerts on new inbox rules, or a simple phone call to a known number.

Warning Signs to Watch For

Attackers succeed when people rush, so train teams to notice these signals.

In the message:

• A request to change bank details, payment method, or payee
• Unusual urgency, secrecy, or pressure to bypass normal steps
• A sender who is unavailable by phone or asks to avoid calls
• A reply-to address that differs from the sender
• A domain that is almost, but not quite, correct
• Slightly different writing style, signature, or greeting than usual
• Payment instructions that differ from prior invoices

In your systems:

• New forwarding or inbox rules nobody created
• Sign-in alerts from unfamiliar places or devices
• Unexpected multi-factor prompts
• New third-party apps connected to mailboxes
• Colleagues receiving odd messages from your account
• Missing replies or emails that seem to vanish

Who Is Most at Risk?

Any business that sends payments or handles sensitive data can be targeted, but some sectors face extra pressure:

• Real estate and title companies: High-value transfers on tight timelines
• Law firms: Trust accounts, settlements, and confidential deals, which makes client confidentiality protection a security priority as well as an ethical one
• Accounting and financial firms: Access to client funds and tax records, and a growing reality that CFO cybersecurity responsibility now sits at the leadership table
• Construction and contracting firms: Frequent vendor payments and progress billing
• Healthcare practices: Billing data, vendor payments, and patient information
• Nonprofits and schools: Grant funds, donations, and thin security budgets
• Distributors and manufacturers: Many suppliers and constant invoice activity

Smaller companies are not spared. Attackers often prefer them because payment controls are lighter and fewer people are watching.

The Real Cost of a BEC Attack

Direct losses are only the beginning:

• The stolen funds, which are often unrecoverable
• Investigation, legal, and recovery expenses
• Time lost across finance, IT, and leadership
• Strained vendor and customer relationships
• Exposure of confidential data found in the mailbox
• Notification duties and possible regulatory questions
• Insurance disputes, higher premiums, or denied claims
• Lasting reputational damage

How to Stop a BEC Attack

No single tool stops BEC. Layered defenses work because every stage of the attack depends on something you can control.

Fix the Process First

Because the final step is a payment approval, process controls are the strongest safeguard:

• Verify by callback: Confirm any bank detail change with a phone number already on file, never one from the email.
• Require dual approval: Set a threshold above which two people must approve payments.
• Separate duties: The person who adds or edits a vendor should not approve payments to that vendor.
• Delay first payments: Hold payments to new or changed accounts for a set period so anomalies can surface.
• Ban urgent exceptions: Make it clear that no executive can override the process by email.
• Protect payroll changes: Require in-person or verified confirmation for direct deposit updates.
• Document the process: Write it down, train on it, and test it.

Secure Email and Identity

Most account takeovers begin with a stolen login, so identity protection is central:

• Enforce multi-factor authentication for every user, favoring phishing-resistant methods such as hardware keys or passkeys
• Adopt modern biometric authentication methods that reduce dependence on passwords that can be phished
• Block legacy authentication protocols that bypass MFA
• Limit which users can approve third-party app access
• Apply conditional access rules based on location, device health, and risk
• Alert on new inbox rules, external forwarding, and new authentication devices
• Deploy SPF, DKIM, and DMARC to reduce spoofing of your own domain
• Turn on external sender banners and lookalike domain detection

The broader identity security shift reflects a simple reality: accounts and permissions, not office walls, now define your perimeter. A zero trust approach verifies every sign-in and grants only the access each role needs. Dedicated email security services add filtering, impersonation protection, and continuous monitoring on top of what your email platform includes.

Getting the underlying tools configured properly matters too. Well-managed email productivity tools can enforce sharing limits and data loss prevention, while thoughtful cloud platform management keeps tenant settings, logging, and access policies consistent. Because payment approvals also happen over voice and chat, communications platform security deserves the same discipline as email.

Secure Devices and Remote Work

A compromised laptop or phone can expose sessions and saved passwords:

• Patch operating systems and browsers promptly
• Encrypt devices and require screen locks
• Use endpoint protection with central alerting
• Set clear rules for personal devices, since secure BYOD policies matter more when staff split time between home and office
• Extend the same safeguards to distributed teams through consistent remote workforce security

Segmentation and monitoring from network security management limit how far an intruder can move, and buying supported, business-grade devices through hardware procurement support avoids consumer equipment that lacks modern security features.

Train People Without Blaming Them

Technology fails when a convincing message lands in front of a busy person, so training is essential:

• Run short, regular sessions instead of one annual lecture
• Use realistic examples, including vendor invoices and executive requests
• Send phishing simulations and celebrate reporting, not just clicking
• Give finance, HR, and executive assistants extra scenarios
• Make it easy to report a suspicious message in one click

Consistent cyber awareness training builds habits that no filter can replace. Employees also need a fast, friendly place to ask questions, and responsive rapid IT support turns a hesitant report into action within minutes.

Detect and Respond Around the Clock

Attackers often act at night or on weekends. Continuous monitoring shortens the time between compromise and response:

• Watch sign-in logs, mailbox rules, and app connections for unusual behavior
• Use managed detection response so suspicious activity is investigated and contained quickly
• Keep an incident response plan with named roles and after-hours contacts
• Preserve logs long enough to support investigations

Mailboxes also hold enormous amounts of sensitive data, so dependable backup and recovery helps you restore records that attackers delete or alter while covering their tracks.

Keep Pace With How Attacks Evolve

Tactics change quickly. Understanding evolving cyber threats helps leaders keep controls current, and awareness of autonomous cyber threats shows why automated attacks scale so easily against smaller businesses. A documented cyber resilience playbook helps your team prepare, respond, and recover in a coordinated way.

Align With Compliance and Insurance

Regulators, clients, and insurers increasingly expect documented controls such as multi-factor authentication, training, and incident response. Practical compliance program support turns those expectations into written policies and audit-ready evidence, and it helps you show due diligence if a loss occurs. Read your cyber policy carefully, because coverage for social engineering and fraudulent transfers varies widely and often has sublimits or specific conditions.

Attack Stages and Matching Defenses

What to Do If You Suspect a BEC Attack

Speed decides how much you can recover. Act in this order:

1. Call your bank immediately. Ask for a wire recall or ACH return and a freeze on the receiving account. Every hour matters.
2. Contain the account. Reset passwords, revoke active sessions, remove unknown devices, and disable suspicious apps.
3. Remove attacker rules. Delete unauthorized inbox rules and external forwarding.
4. Preserve evidence. Keep messages, headers, and logs intact for investigators, and avoid wiping systems.
5. Report the crime. File a complaint with the FBI’s Internet Crime Complaint Center and contact local law enforcement.
6. Notify your insurer and counsel. Policies often have strict reporting windows.
7. Alert affected parties. Warn vendors, customers, and staff whose data or identity may be involved, and tell them to verify any recent requests.
8. Investigate scope. Determine which mailboxes, files, and payments were touched.
9. Close the gap. Fix the weakness that allowed access and update procedures.
10. Debrief and document. Record the timeline and lessons so the next attempt fails.

A Simple 30-Day Plan

• Week 1, Assess: List who can approve payments, change vendor details, and update payroll. Review mailbox rules, forwarding, and connected apps for surprises.
• Week 2, Lock down: Enforce multi-factor authentication, block legacy sign-in, and turn on alerts for new rules and forwarding.
• Week 3, Standardize: Publish a written payment verification policy, set dual approval thresholds, and train finance and executive staff.
• Week 4, Rehearse: Run a tabletop exercise using a fake vendor change request, and confirm your bank contacts and after-hours reporting path. For a longer roadmap, IT strategy planning can connect these steps to budgets and priorities.

A provider of fully managed IT can keep patching, monitoring, and user management on schedule so these controls stay in place after the initial push.

Turning Awareness Into Protection

A BEC attack is rarely a single moment. It is a chain of steps: research, a stolen login or a convincing fake, quiet observation, a well-timed request, and a fast transfer. The encouraging truth is that the chain can be broken at almost any link. Phishing-resistant sign-in, smart email security, monitoring, trained employees, and a firm rule that payment changes are always verified by phone turn a likely loss into a routine, harmless phone call.

The team at CMIT Solutions of Austin Downtown and West helps Austin businesses build these protections, from email and identity security to monitoring, backup, compliance documentation, and everyday IT support. If you want to know where your payment processes and mailboxes are exposed and how to close the gaps, schedule a consultation and get a practical plan built around your team, your workflows, and your risks.
“`html id=”becfaq1″