Business email compromise still works for one simple reason: it exploits routine. Most companies do not lose money because they lack a policy on paper. They lose money because a rushed payment, a convincing email thread, and an unclear approval path meet on the same afternoon.
Why BEC still works
The FBI continues to treat business email compromise as a major fraud category in its latest IC3 reporting, and the pattern is familiar: spoofed accounts, compromised inboxes, spearphishing, and urgent requests that pressure someone to act before they verify. The FBI’s guidance on business email compromise is blunt about the method because the method is blunt. Attackers want speed, confusion, and silence.
That is why the threat is not just technical. Verizon’s latest DBIR coverage keeps pointing back to the human element, stolen credentials, phishing, and mobile-heavy social engineering. ENISA’s current threat landscape report adds the larger context: dependencies are expanding, and the attack surface follows them. A company can have good filters and still lose money if its people have no habit of pausing, checking, and escalating.
Security culture is the control layer
Security culture is not a slogan. It is the set of repeatable behaviors that decide whether a suspicious message gets stopped or paid. Good culture gives staff three things:
- Permission to verify before acting on money, credentials, or sensitive instructions.
- A clear path to escalate when a request feels unusual, urgent, or private.
- Leadership support when someone slows the process down for a check.
That matters because fraud usually exploits one weak link, not a full collapse. A vendor changes bank details. An executive asks for a fast transfer. A mailbox thread is already compromised, so the reply looks normal. Or a mobile message arrives when the team is away from the desk and more willing to trust the moment than the workflow.
If your organization needs a broader operating model, review the practical guidance on services and the background on about us. For related posts, see the blog index.
Where companies usually fail
The failures are predictable, which is unfortunate because predictability is the enemy here.
| Failure point | What it looks like | Better control |
|---|---|---|
| Invoice changes | A supplier “updates” payment details by email | Verify bank changes through a known phone number or portal, not the same thread |
| Executive impersonation | A message appears to come from a senior leader asking for speed and secrecy | Require dual approval and out-of-band confirmation |
| Compromised email thread | Attackers reply inside an existing conversation | Check for subtle domain changes and unusual urgency |
| Mobile social engineering | A quick text or chat message pushes action outside normal process | Route payment and account changes back to the formal workflow |
Policies that actually help
Policy works when it is short enough to remember and strict enough to matter. The practical controls are familiar:
- Dual approval for payments and bank detail changes. One person can request; two people must confirm.
- Out-of-band verification. Call back using a trusted number, or confirm through a known internal channel.
- Domain lookalike checks. Train staff to look for misspellings, extra characters, and reply-to tricks.
- Escalation without punishment. A false alarm costs time. A missed fraud attempt costs more.
- Regular drills. Practice on invoice fraud, payroll changes, and urgent executive requests, not just generic phishing tests.
For companies that want a broader baseline on threat reporting, the FBI’s IC3 annual report and the Verizon DBIR are worth reading directly. The numbers and examples are different, but the lesson is stable: people are part of the security boundary.
Leadership sets the standard
If leaders reward speed over verification, staff will eventually stop asking questions. If leaders treat a pause as competence, the culture changes. The strongest teams make verification normal. They do not praise recklessness dressed up as decisiveness.
That leadership posture should include:
- visible support for staff who pause a payment;
- clear ownership for who can approve what;
- no-blame reporting when someone spots a suspicious message;
- simple incident reporting channels that work under pressure.
For organizations that need to connect fraud response to broader risk handling, the practical next step is often the same: map who approves money, who verifies identity, and who gets called when a message does not look right. If those answers are fuzzy, the process is already leaking risk.
For a practical next step, review your payment workflow this quarter, confirm the reporting path, and refresh staff on suspicious-message handling before the next urgent request arrives. If your team needs a structured review, start with the problem-solving overview and work forward from there.
Bottom line: BEC succeeds when routine outruns verification. Companies stop it when they make checking normal, escalation easy, and approval paths hard to fake.