BEC

BEC most commonly refers to Business Email Compromise, a form of cybercrime that targets organizations by compromising legitimate business email accounts or impersonating executives to deceive employees into transferring money or sharing sensitive information.

In a typical attack, perpetrators use phishing, malware, or social engineering to gain access to an email account or to spoof a trusted sender. Once inside, they may request urgent wire transfers, alter payment instructions, or request confidential data while appearing to come from a known executive or supplier.

Common schemes include vendor invoice fraud, where invoices are redirected to attacker-controlled bank accounts, and executive impersonation, where finance staff are pressured to authorize fraudulent payments. Attacks often involve domain spoofing, look-alike addresses, or compromised vendor correspondence to lower suspicion.

Impact can be substantial, including direct financial losses, disrupted operations, and damage to business relationships. The prevalence of BEC has grown alongside increasing reliance on digital payments and remote work, prompting responses from government and industry groups.

Prevention and response involve a combination of technical, procedural, and educational measures. Technical controls include multi-factor authentication for email accounts and domain authentication (DMARC, SPF, DKIM). Procedural controls include strict payment verification, separate approval workflows, and vendor verification. User training and simulated phishing can reduce susceptibility, and organizations should have an incident response plan and cooperate with law enforcement when incidents occur.

Other uses: BEC is an acronym used in different contexts outside cybersecurity; this article covers the cybersecurity meaning most common in business and technology.