Business email compromise (BEC) explained
2 min read · Updated October 15, 2026
Business email compromise is a fraud where attackers impersonate or take over a trusted email account to trick staff into sending money or sensitive data. Defend against it with MFA, email authentication, a mandatory callback check for payment changes and staff awareness.
How BEC works
An attacker either compromises a real mailbox or spoofs a similar address, studies how the business handles payments, then inserts a fake request at the right moment: a new bank account for an invoice, an urgent transfer or a gift-card purchase.
Common variants
- ✓Fake invoice or supplier bank-detail change.
- ✓Executive impersonation asking for an urgent payment.
- ✓Payroll diversion: an ‘employee’ asks to change direct-deposit details.
- ✓Account takeover of a real mailbox used to message customers or suppliers.
See how exposed your team’s email is
Leaked work emails fuel phishing and account takeover. Review your company’s exposure with a corporate audit.
Warning signs
- ✓A request to change payment details, especially with urgency or secrecy.
- ✓Slightly different sender address or reply-to.
- ✓Out-of-character tone or timing.
- ✓Pressure to bypass normal approval steps.
Controls that work
- ✓Multi-factor authentication on all email accounts.
- ✓SPF, DKIM and DMARC for your domain.
- ✓Dual approval and callback verification for payments and bank-detail changes.
- ✓Alerts for new forwarding rules and unusual sign-ins.
- ✓Regular training with realistic examples.
Frequently asked questions
Is BEC only a problem for large companies?+
No. Small businesses are frequent targets because they often have fewer approval controls.
What should we do if we paid a fake invoice?+
Contact your bank immediately to try to recall the payment, then report the incident to the authorities and secure affected accounts.
How does breach data help attackers?+
Leaked emails and passwords provide access or targeting information to start the scam.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.