Business email compromise is fraud carried out through a real email account or a convincing imitation of one. No malware, no broken firewall. Someone asks a colleague to change bank details or approve a payment, the request looks entirely normal, and the money goes to the wrong account.
It is the attack that most often turns a security incident into a financial loss, and the controls that stop it are not the ones most businesses reach for first.
Every technical control can work perfectly and the fraud still succeeds, because nothing was broken into. A person was asked to do their job and did it.
What Is Business Email Compromise?
Fraud that arrives as a credible email rather than an attack. The attacker either controls a genuine mailbox or impersonates one closely enough to pass, then uses it to redirect a payment. The request is plausible because the context is real: an invoice that exists, a supplier you use, a director who does send that kind of message.
What separates it from ordinary fraud is the absence of anything suspicious. There is no attachment to scan, no link to block, no malware signature. The email is text, and the only thing wrong with it is the account number.
That is also why it defeats the usual defences. A filter tuned to catch malicious payloads has nothing to catch, and a person trained to spot a badly written scam is reading something well written and entirely expected. Transputec treats this as a payments problem with a technical component, rather than the other way round.
How Does a Business Email Compromise Attack Work?
In four stages, and only the last one looks like fraud. The attacker gets into or alongside the email flow, watches long enough to learn how money moves, waits for a live transaction, then intervenes at the point a payment is already expected. The patience is the point.
Access. Usually a stolen session rather than a stolen password. Microsoft traced adversary-in-the-middle phishing straight into this crime, which we covered in our post on AiTM phishing. The attacker ends up inside a genuine mailbox.
Observation. They read. Who approves payments, which suppliers are mid-invoice, how your finance team phrases things, when the director is travelling. Mailbox rules often get created here to hide replies from the real user.
Insertion. They reply inside an existing thread, from the real address, with correct history beneath. New bank details, a plausible reason, no urgency that would feel odd.
Collection. The payment lands, moves on quickly, and is usually unrecoverable by the time anyone queries it.
Worried About the Payment Requests You Cannot See?
Transputec deploys Mimecast for anti-phishing, impersonation defence and business email compromise protection, with a 24/7 UK managed SOC watching the sign-ins and mailbox rules behind them. Talk to our team about the security work behind your payment approvals.
Get a Strategic ConsultationHow Is It Different From Phishing?
Phishing wants a credential. Business email compromise wants a payment. That changes the content, the detection and the response, which is why treating them as one problem leaves a gap exactly where the money is. Phishing is often the way in; this is what happens next.
| Phishing | Business email compromise | |
|---|---|---|
| Goal | Credentials or a malware foothold | A payment redirected to the attacker |
| Sent from | A spoofed or lookalike address | Often a genuine, compromised account |
| Contains | A link or attachment | Plain text, nothing to scan |
| Caught by | Email filtering, link rewriting | Process, not technology |
| Damage | Access, which can be revoked | Money, which usually cannot |
The last row is the one finance teams should read. A phished password is recoverable. A transferred payment, in most cases, is not. We set out the related distinction in our post on spear phishing versus phishing.
What Does It Cost UK Businesses?
Authorised push payment fraud, the category this sits in, is rising. UK Finance reported that APP fraud losses reached £576.4 million in 2025, up 19%, across 248,070 cases. Total payment fraud came to £1.28 billion. These are payments people made themselves, believing the request was genuine.
Where it starts is the useful part. UK Finance found 66% of APP fraud cases originated online, accounting for 32% of losses, with telecommunications behind a further 17% of cases and 28% of losses.
One figure cuts against the alarm, and it is worth stating. Impersonation fraud losses fell 12% and case numbers fell 11%. The controls work where they have been applied, which is a better argument for applying them than any projection.
For context on how the attack arrives, the government’s Cyber Security Breaches Survey found phishing remained the most prevalent type of breach or attack by far, experienced by 38% of businesses.
What Are the Common Variants?
Four keep recurring, and they differ by who is being imitated rather than by technique. Recognising which one you are looking at matters less than having a process that catches all of them, but the shapes are worth knowing because they tell you which team is exposed.
Invoice redirection. A supplier’s bank details change mid-relationship. The most common and the most expensive, because the amounts are already agreed.
Executive impersonation. A request from someone senior, usually urgent, usually while they are conveniently unreachable. It works on hierarchy rather than on credibility.
Payroll diversion. An employee appears to ask HR to change their bank details before payday. Small individually, easy to repeat.
Supplier account takeover. The compromised mailbox belongs to your supplier, not you. Your controls are intact and the fraud still reaches you, which is why this one is the hardest to argue your way out of.
How Do You Stop Business Email Compromise?
With a payment process, not a product. Every control that matters here sits outside the email system, because the email is genuine. The single most effective rule is that bank detail changes are verified by voice on a number you already hold, never a number in the email.
Make that rule unconditional. A verification step that can be waived for urgency will be waived precisely when the attacker wants it waived, because manufactured urgency is the whole technique.
Add dual authorisation above a threshold you set deliberately. Two people who both know the rule are far harder to rush than one person who is trying to be helpful. Transputec sets the alerting up so the mailbox side is watched while finance runs the process side.
Then close the access route. Passkeys stop the session theft that gets an attacker into the mailbox, and alerting on new mailbox rules catches the ones already inside. When something does get through, the phishing playbook decides how much it costs.
What Should Finance and HR Be Told?
That a correct-looking email is not evidence. The hardest part of defending against business email compromise is that the message really does come from the person it appears to, in a thread they really are part of, about an invoice that really exists. Nothing looks wrong because nothing is wrong except the destination.
Give them explicit permission to slow down. Most successful fraud of this type works because somebody did not want to question a director or delay a supplier, so the authority to pause has to come from above them, in writing.
And make raising a false alarm cost nothing. A finance assistant who checks an unnecessary payment ten times is cheaper than one who does not check the eleventh.
Your Payment Controls Checklist
Work through these with finance rather than with IT.
- Verify every bank detail change by voice, on a number you already held.
- Make that step unwaivable, including for the chief executive.
- Set a value above which two people must authorise, and write the threshold down.
- Alert on mailbox rules created shortly after a sign-in.
- Move finance, payroll and executives to phishing-resistant sign-in first.
- Agree who to call at the bank, before you need to call them.
- Tell staff plainly that questioning a payment will never be held against them.
Conclusion
Business email compromise succeeds because nothing about it looks like an attack. The account is real, the thread is real, the invoice is real, and the only false detail is where the money goes. That is why filtering alone never closes it.
The fix is unglamorous and it works: verify bank changes by voice, authorise large payments in pairs, close the session-theft route into the mailbox, and watch for the rules an intruder leaves behind. Transputec covers the technical half through Mimecast and cyber security services. The other half is a process your finance team owns. Talk to us about the security work behind your payment approvals.
FAQs
What Is Business Email Compromise?
Fraud carried out through a genuine email account or a convincing imitation of one, aimed at redirecting a payment. There is usually no malware and no link, which is why email filtering often does not catch it. The request looks normal because the context is real.
How Is BEC Different From Phishing?
Phishing wants credentials or a malware foothold and usually arrives with a link or attachment. BEC wants a payment and often arrives as plain text from a real account. Phishing is frequently how the attacker gets in; BEC is what they do next. A phished password can be reset, a transferred payment usually cannot be recovered.
How Much Does This Fraud Cost in the UK?
UK Finance reported authorised push payment fraud losses of £576.4 million in 2025, up 19%, across 248,070 cases, within total payment fraud of £1.28 billion. Notably, impersonation fraud losses fell 12% over the same period, which suggests the controls work where they are used.
What Is the Single Most Effective Control?
Verifying any change to bank details by voice, on a phone number you already held, never one supplied in the email. It has to be unwaivable, because manufactured urgency is the technique, and a rule that can be skipped for urgent requests will be skipped at exactly the wrong moment.
Can Email Security Software Stop It On Its Own?
It helps but it cannot finish the job. Impersonation defence and anti-phishing reduce what reaches the inbox, and closing off session theft keeps attackers out of mailboxes, which is the half Transputec covers. But when the email genuinely comes from a compromised supplier account, the control that stops the loss is a payment process, not a filter.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
