Business Email Compromise (BEC): How to Recognize and Prevent It

Business Email Compromise is one of the most financially damaging forms of cybercrime. Unlike phishing that targets employees en masse, BEC is targeted: attackers research a company, identify who controls money or sensitive data, and craft a convincing email that looks like it comes from a trusted source.

The FBI's Internet Crime Complaint Center reported over $2.9 billion in losses from BEC in a single year. The attacks succeed not because they exploit software vulnerabilities, but because they exploit trust.

What BEC attacks look like

CEO fraud

An employee in accounting receives an email that appears to be from the CEO: "I need you to wire $80,000 to this account by end of day. Don't tell anyone — this is confidential." The email address looks right. The tone matches how the CEO writes. The employee sends the money.

Vendor invoice fraud

After monitoring a company's email communication for weeks, an attacker sends a fake invoice from a vendor the company regularly pays, but with updated banking details. Payments go to the attacker's account rather than the legitimate vendor.

Attorney impersonation

A law firm or attorney is impersonated during a real estate closing or corporate acquisition, redirecting wire transfers to a fraudulent account at the exact moment when large sums are legitimately expected to move.

Why BEC works

BEC succeeds for several reasons:

• Domain spoofing: Attackers send from ceo@company-corp.com instead of ceo@company.com — a difference easily missed in a busy inbox
• Display name spoofing: The visible name says "Jane Smith, CEO" but the actual sending address is a Gmail or Yahoo account
• Lookalike domains: Attackers register cornpany.com (with an rn that looks like m) and send from there
• Compromised accounts: Sometimes attackers actually gain access to a legitimate account, so the email really does come from the right address

Technical defenses: SPF, DKIM, and DMARC

Email authentication records are your first line of defense against domain spoofing.

SPF (Sender Policy Framework)

SPF lets you declare which mail servers are authorized to send email from your domain. A receiving mail server checks the SPF record before accepting a message:

v=spf1 include:_spf.rovela.dev ~all

SPF alone is not sufficient — it only checks the envelope sender address (used during SMTP), not the From header that users see.

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to outgoing messages. The private key signs the message headers and body; the public key is published in DNS. Recipients verify the signature to confirm the message was not altered in transit and genuinely came from a server with access to the private key.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC ties SPF and DKIM together and tells receivers what to do when both fail:

v=DMARC1; p=reject; rua=mailto:dmarc-reports@company.com

The p=reject policy instructs receiving servers to discard messages that fail DMARC alignment. This closes the display-name spoofing gap: the From header domain must align with either the SPF domain or the DKIM signing domain.

Important: Start with p=none (monitoring mode) to collect reports and understand your email flow before moving to p=quarantine or p=reject. Jumping straight to p=reject without reviewing reports can cause legitimate email to be dropped.

Process and procedural defenses

Technical controls cannot stop all BEC — attackers who compromise a legitimate account bypass authentication entirely. Procedural controls are equally important.

Verify financial requests out of band

Establish a firm policy: any request to change payment details or initiate an unusual wire transfer must be confirmed by phone or in person using a number from your records, not from the email itself. This single control stops the majority of BEC attacks that use impersonation.

Set dollar thresholds requiring multiple approvals

A second approver for any wire transfer above a threshold means an attacker must compromise two accounts, not one.

Train employees to scrutinize urgent, confidential requests

BEC emails almost always create urgency and secrecy: "I need this now" and "don't tell anyone." These are manipulation tactics. Employees who recognize them are less likely to skip verification steps.

Check sender domains carefully

Train your accounts payable team to inspect the full email address, not just the display name. Browser and email client UI often hides the actual address — employees should click or hover to see it.

What to do if you're targeted

If you receive a suspicious email, do not reply to it. Contact the apparent sender through a known-good channel to verify. If a transfer has already been made, contact your bank immediately — wire recalls within the first 24 hours have a meaningful success rate. Report the incident to the FBI's IC3 (ic3.gov) and your local law enforcement.

Sending email at scale: protecting your domain's reputation

If your organization sends marketing or transactional email through an email API, the same authentication requirements apply. Every email sent through Rovela uses your verified domain with properly configured SPF, DKIM, and DMARC. When you add a domain, Rovela generates DKIM keys and shows you exactly which DNS records to publish.

Maintaining a clean sender reputation — low bounce rates, few spam complaints, authenticated messages — also makes your domain less attractive to BEC attackers, because a high-reputation domain that suddenly sends fraudulent messages is more likely to trigger filtering heuristics.