Here's a number that should genuinely concern you: $2.9 billion. That's how much business email compromise (BEC) cost American businesses in 2023, according to the FBI's Internet Crime Complaint Center. Not ransomware. Not crypto scams. Email. Plain, boring, text-based email.
BEC is the single most expensive category of cybercrime the FBI tracks, and it has been for years. But here's the thing that makes it genuinely insidious: there's usually no malware involved. No virus. No suspicious attachment. No sketchy link. The attacker just... sends an email. And it works because the email looks like it came from someone the victim trusts.
Let me walk you through exactly how this works, because understanding the mechanics is the first step to not falling for it.
What BEC actually is (and isn't)
BEC is not phishing in the traditional sense. Traditional phishing casts a wide net: send a million fake PayPal emails and hope 0.1% of people click. BEC is targeted. The attacker researches your business, figures out who handles money, learns how your company communicates, and then impersonates someone specific, your CEO, your vendor, your attorney, your accountant.
The FBI defines BEC as a sophisticated scam targeting both businesses and individuals performing legitimate transfer-of-funds requests. The key word is "legitimate." The transactions BEC attackers hijack are real. They just redirect the money.
There are a few flavors, but the most common ones for small businesses are:
CEO fraud. The attacker impersonates your boss or business owner and emails someone in accounting with an urgent wire transfer request. "I need you to process this payment today. I'm in a meeting and can't talk. Just handle it." The Anti-Phishing Working Group found that CEO impersonation accounts for about 25% of all BEC attacks.
Vendor impersonation. The attacker pretends to be a vendor you actually work with and sends "updated" payment instructions. "We've changed banks. Please send future payments to this new account." The email uses the vendor's real name, references real invoices, and looks completely normal. In one documented case, attackers intercepted real invoice threads between companies and injected fraudulent banking details mid-conversation.
Attorney impersonation. This one hits hard during real estate closings, mergers, and any transaction where large wire transfers are normal. The attacker impersonates the attorney handling the deal and sends wire instructions to the buyer. The Real Estate Wire Fraud Advisory from the FBI specifically warns about this scenario because it's so common and the dollar amounts are so high.
How the attacker gets in position
Here's the part most articles skip. The attacker doesn't just guess. They get into position first, and there are two main ways they do it.
Method 1: Compromised email account. The attacker gets access to a real email account at your company (or your vendor's company) through a separate phishing attack or credential theft. Once inside, they read email threads, learn the relationships, study how requests are phrased, and then strike at the right moment. They might even set up email forwarding rules so they can monitor conversations silently for weeks. Microsoft's Digital Defense Report found that attackers typically spend 1-4 weeks inside a compromised mailbox before executing the BEC attack.
Method 2: Domain spoofing. The attacker registers a domain that looks almost identical to yours. If your company is acmeconsulting.com, they register acmeconsultiing.com (double "i") or acme-consulting.com. Then they send emails from that lookalike domain. At a glance, it looks legit. This is where email authentication protocols become critical (more on that in a minute).
What stops this
Let me be real with you: there's no single tool that prevents BEC. It's a combination of technical controls and human awareness. But the technical controls do most of the heavy lifting.
SPF, DKIM, and DMARC (the email authentication trifecta)
These are three protocols that work together to verify that an email actually came from who it claims to come from. Think of them like the security features on a check: the watermark, the signature, and the bank verification.
SPF (Sender Policy Framework) is a DNS record (DNS is basically the internet's phone book, a system that translates human-readable domain names into the IP addresses computers use) that lists which servers are allowed to send email on behalf of your domain. If someone sends an email claiming to be from your domain but it didn't come from an authorized server, SPF flags it.
DKIM (DomainKeys Identified Mail) adds a digital signature to every email your server sends. The receiving server can verify that signature to confirm the email wasn't tampered with in transit. Think of it like a wax seal on a letter. If the seal is broken, you know someone messed with it.
DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together and tells receiving servers what to do when an email fails authentication. You can set it to monitor only (just report failures), quarantine (send failures to spam), or reject (block them entirely).
Here's the critical part: according to Valimail's 2024 Email Authentication Report, only about 30% of domains have DMARC set to enforcement (quarantine or reject). That means 70% of domains are either not using DMARC at all or have it set to "do nothing," which means spoofed emails still get delivered.
Setting up SPF, DKIM, and DMARC isn't optional anymore. It's foundational small business cybersecurity. And as of February 2024, Google and Yahoo require DMARC for bulk email senders. The writing is on the wall.
Multi-factor authentication on every email account
If an attacker can't get into your email account, they can't use Method 1 (the compromised mailbox approach). MFA (multi-factor authentication, meaning you need something beyond just a password to log in, like a code from your phone) stops the vast majority of account takeover attempts. Microsoft has said it blocks 99.9% of automated account attacks.
The human layer: verification procedures
Technical controls handle the automated attacks. The human layer handles the social engineering. Every business that moves money should have one simple rule: any change to payment instructions must be verified by phone using a number you already have on file. Not the number in the email requesting the change. The number you already know is real.
That's it. If someone emails you new wire instructions, pick up the phone, call the number you've always used for that vendor, and ask "did you just change your banking information?" This one step would have prevented the majority of BEC losses last year.
You now know more than most
BEC works because it exploits trust and routine. It targets the exact moments when people are busy, rushing, and unlikely to question a request that looks normal. The defense isn't complicated: authenticate your email (SPF, DKIM, DMARC), protect your accounts (MFA on everything), and verify payment changes by phone. Three layers. None of them are expensive. All of them are effective. And now you know exactly how the attack works, which makes you significantly harder to fool.
