us:
English: Americas
Business email compromise (BEC) attacks are one of the costliest forms of cybercrime. They're also some of the hardest to detect because they have fewer obvious red flags. Unlike traditional phishing attacks, BEC attacks don't rely on malicious links or attachments. Instead, they use social engineering tactics to convince employees to perform wire transfers, change payment details, share sensitive data, and more.
Since 2013, BEC has led to more than US$55 billion in attempted or actual losses worldwide across more than 300,000 attacks. As organizations rely more on cloud email platforms and agentic AI workflows, attackers have more opportunities to exploit trust, timing, and processes.
To reduce risk, organizations need to look beyond traditional email security controls and focus on how these attacks actually succeed.
Below, we break down why BEC attacks continue to get through and what it takes to prevent them in modern environments.
What is business email compromise (BEC)?
Business email compromise is a targeted attack in which a threat actor impersonates a trusted person, such as an executive, colleague, or vendor, to trick employees into transferring funds, changing payment details or sharing sensitive information.
BEC attacks work because they look like legitimate requests. Attackers often use compromised accounts or insert themselves into existing email threads, so their actions appear to be normal business communications.
Many BEC attacks are also closely tied to email account compromise (EAC). In these cases, an attacker gains access to a legitimate mailbox, allowing them to bypass traditional defenses and send hard-to-detect fraudulent emails.
Why are BEC attacks increasing?
BEC attacks are nothing new, but in recent years, several trends and innovations have made them more effective.
AI-powered social engineering at scale
Generative AI makes it fast and easy for attackers to create convincing messages that match tone, language, and context to specific people or situations. Combined with public information about employees and vendors, this allows attackers to scale highly targeted BEC campaigns.
Greater use of cloud email platforms
Platforms like Microsoft 365 make it easier for employees to communicate and collaborate, but they also create new risks. If attackers gain access to a legitimate account, they can move laterally inside the environment and send legitimate-looking messages.
Increased reliance on digital business processes
Processes like financial approvals, vendor management, and internal requests have moved online. They've sped up as a result, and employees are expected to act quickly on routine approvals and updates. Attackers exploit this, knowing small anomalies are more likely to go unnoticed.
Gaps in security awareness and training
Employees are often not properly trained to recognize sophisticated attacks. Many training programs emphasize basic phishing scenarios over targeted fraud like BEC. Without clear guidance on when and how to verify requests, even experienced employees can make costly mistakes.
How do BEC attacks bypass traditional email security?
On top of increasing the volume of attacks, these trends also expose the limits of legacy controls.
Many organizations rely exclusively on filtering and authentication protocols such as DMARC. These controls are necessary, but they're mainly built to detect malicious content and known threats—and BEC attacks don't behave that way.
In most BEC attacks:
- There's no malicious link or attachment to scan
- The sender may be a legitimate or compromised account
- Messages may be part of an existing conversation
- Internal emails are often trusted by default
Authentication helps reduce domain spoofing, but it doesn't stop attacks that rely on compromised accounts or trusted relationships. Attackers also use techniques such as slightly altered domains, inserting themselves into ongoing email threads and impersonating vendors involved in real transactions. These approaches rely on familiarity and context, not technical exploits.
As a result, controls that focus only on email content or sender reputation tend to miss the signals that matter most: how people communicate, who they trust, and whether a request fits normal behavior. Detecting these signals requires a different approach.
How to prevent business email compromise attacks
Reducing BEC risk calls for a layered approach focused on identity, behavior, and business processes. In practice, that means:
- Understanding communication patterns and relationships
- Applying controls to internal and high-risk communications
- Training employees to recognize and verify suspicious requests
- Using authentication protocols as part of a broader detection strategy
- Monitoring for account compromise and unusual activity
1. Analyze communication patterns and relationships
BEC attacks rely on mimicking legitimate communication, so you need to understand how your users typically interact. An effective BEC protection solution will help you:
- Map who users normally communicate with
- Identify requests that don't match typical tone or format
- Flag interactions that don't align with established relationships
2. Apply controls to internal and risky communications
Internal visibility and control make it more difficult for attackers to abuse compromised accounts. You need protections that extend beyond the email perimeter and enable you to:
- Monitor internal emails for unusual or high-risk activity
- Apply stricter controls to finance, HR, and executive roles
- Flag messages that introduce urgency or unusual financial requests
3. Provide targeted employee training
Your employees are your last line of defense against BEC attacks, and training needs to reflect what they're actually seeing in the wild. You need ongoing, role-specific security awareness training that prepares them to:
- Identify executive impersonation attempts
- Recognize vendor and invoice fraud scenarios
- Spot warning signs and question requests that bypass normal processes
4. Use authentication protocols as part of a broader strategy
Authentication protocols help reduce spoofing risk, but they are only one part of the solution. You need to implement them alongside identity and behavior-based controls to:
- Prevent domain spoofing using DMARC, SPF and DKIM
- Detect threats that bypass authentication, such as compromised accounts
- Identify conversation hijacking and social engineering attempts
- Strengthen overall email and identity security posture
5. Monitor for account compromise and abnormal activity
Detecting unusual behavior early can prevent attackers from gaining access or dwelling in your environment. You need visibility into user activity and account behavior that enables you to:
- Identify logins that don't match normal patterns
- Detect sudden changes in sending behavior
- Monitor for suspicious mailbox rules or activity
What works against BEC
Reducing BEC risk means focusing less on filtering messages and more on how attackers exploit people, relationships, and workflows.
Effective defenses are built around the ability to:
- Detect identity compromise early
- Identify abnormal communication behavior
- Monitor vendor and payment interactions
- Gain visibility into cloud environments such as Microsoft 365
BEC is a business process problem, which is why stopping it requires coordinated controls across people, technology, and workflows. The next step is implementing them in a way that works in your environment.
How Proofpoint can help
Many organizations already have email security in place, but BEC attacks still get through. The issue is that they don’t look malicious—they look like normal business communication, which makes them difficult for traditional controls to detect.
Proofpoint closes that gap with a human-centric approach to email security, enabling you to:
- Detect compromised accounts and identity misuse early
- Identify fraudulent requests that appear legitimate
- Protect payment workflows and vendor communications
- Gain visibility into threats across environments like Microsoft 365
Proofpoint Core Email Protection uses AI, behavioral analysis, and threat intelligence to stop advanced email threats, including BEC, phishing, and account takeover. It supports both secure email gateway and API-based deployments, so you can protect your environment in the way that fits your organization.
In many cases, gaps in BEC protection only become visible when an attack gets through. Ready to close the gaps in your email security?
