Business email compromise: how small firms get caught, and how to stop it

What business email compromise is

Business email compromise, or BEC, is a scam where a criminal uses a hijacked or lookalike email account to pose as someone your business trusts, usually to redirect a payment. The “someone” might be a supplier, your managing director or a colleague in the next room.

There's often no dodgy attachment and no suspicious link. The email simply asks for something that sounds routine: pay this invoice to a new account, send a transfer before the end of the day, update my bank details for payroll. Small firms suit it well: one or two people often handle every payment, and everyone knows each other well enough to skip the formalities.

Two ways in: a taken-over mailbox or a lookalike domain

1. Mailbox takeover

The attacker gets into a real mailbox, yours or a supplier's, usually after an ordinary phishing email collects a password. Then they read quietly, learning who pays whom and when. Often they add a forwarding rule or a filter that hides replies, so the real owner never sees the hijacked conversation.

Because the email comes from a genuine address, inside a genuine thread, nothing about the sender looks wrong.

2. Lookalike domain

No break-in needed. The attacker registers a domain that is one letter, hyphen or ending away from the real one, such as acme-ltd.example instead of acmeltd.example. They copy names and signatures from your website or earlier emails. On a phone, where the full address is often hidden, the difference is easy to miss.

Supplier, CEO and payroll scams

Supplier fraud

A “supplier” tells you they've changed banks just before a real invoice is due. We've covered it step by step in our guide to invoice fraud and payment diversion.

CEO fraud

An email “from the boss” asks for an urgent, confidential payment while they're supposedly travelling. It may be followed by a call or voice note that sounds just like them. Our piece on voice clones and deepfake CEO fraud covers that side.

Payroll diversion

An employee “asks” whoever runs payroll to switch their salary to a new account. It's small and believable. The real employee only notices when their pay doesn't arrive.

The red flags

Any one of these deserves a pause. Two together should stop the payment until you've checked.

• Any change to how money moves. New bank details, a new payee, a one-off transfer outside the usual run.
• A sender address that's nearly right. Read the full address, not just the display name.
• Urgency. “Before 3pm”, “before payroll closes”, “the account shuts on Friday”.
• Secrecy. “Keep this between us for now” is a reason to tell someone.
• Avoiding a conversation. “I'm in meetings, email is best” or a phone number you've never seen before.
• A reply-to address that differs from the sender. Replies quietly go somewhere else.

With a taken-over mailbox the sender will be exactly right, so judge the request, not the address.

Five controls that stop it

None of these needs a security team.

1. Turn on multi-factor authentication for every mailbox. Both Google Workspace and Zoho Mail support it. A stolen password on its own is then much less useful, which makes mailbox takeover harder.
2. Call back on a known number. Any request to change bank details or make an unusual payment gets a phone call to a number you already hold, never one from the email. Ask them to read the details out to you.
3. Two people for new payees. One person sets up a new payee or changes bank details; a second approves it. It also takes the pressure off whoever received the email.
4. Check forwarding rules and filters. Once a month, have whoever runs your email look at each mailbox for forwarding addresses and filters nobody remembers creating. They're a common sign of a quiet takeover.
5. Watch your domain. Set up SPF, DKIM and DMARC so others can't easily send email as your exact domain, and keep an eye out for newly registered lookalikes of your name. Your email or domain provider can usually help with both.

Then write the rule down in one sentence everyone knows: “We never change bank details or make urgent payments on the strength of an email alone.” Back people up when they follow it, even when it holds a payment up.

If it happens to you

Speed matters more than anything else. Do these in order.

1. Call your bank first. Use the number on your card, or call 159 to reach many UK banks' fraud teams. Ask them to contact the bank that received the money.
2. Report it. In England, Wales and Northern Ireland, report to Report Fraud at reportfraud.police.uk (it replaced Action Fraud). In Scotland, call Police Scotland on 101.
3. Forward the email to report@phishing.gov.uk, the NCSC's Suspicious Email Reporting Service, and keep the original for your bank or the police.
4. Secure the mailbox. Change the password, sign out other sessions, turn on MFA and remove any forwarding rules or filters you didn't set up.
5. Warn the people involved. Phone the supplier or colleague who was impersonated.

Don't blame whoever made the payment. They were targeted by someone who studied your business. A quick, calm report is what helps.

Spotting the pattern gets easier with practice. Lureproof sends small teams on Google Workspace or Zoho realistic practice emails, including an overdue-invoice lure, and turns a click into a 60-second lesson. It's free for up to five people, and our free security training is open to everyone.

FAQ