What is a business email compromise (BEC) attack?

BEC is a targeted attack where the attacker gains access to a company email account, sets up quiet forwarding rules, observes transactions and communication patterns for weeks or months, then intercepts a specific large transaction by swapping bank details on an invoice or redirecting a wire transfer.

How do BEC attackers get into email accounts?

Most commonly through phishing, credential stuffing (reused passwords), or stolen tokens. Multi-factor authentication blocks the majority of these attempts. Missing MFA is the single most common precursor to BEC losses.

How can I detect BEC before the attack completes?

Regular audits of email forwarding rules. Alerts on new admin-level rules or rules forwarding to external addresses. Anomaly detection on login patterns (geographic, time-of-day). Callback verification protocols on large payments.

Business Email Compromise: How Hackers Wait for the Big Invoice

Name: HJZ Productions
Address: New York, NY, US
Telephone: +1-917-453-2251
Price range: $$$

TL;DR

The attack: Attacker gets into email, sets up hidden forwarding, watches for weeks, intercepts the big transaction.
Why it works: By the time you notice, the wire has already been sent to a fraudulent account and laundered through multiple accounts.
The block: MFA everywhere + forwarding rule audits + callback protocol for large payments.

Most people picture cyberattacks as loud. Ransomware locking your screen. A defacement on your website. Servers going offline.

Business email compromise is the opposite. It's the quiet attack. You don't know it happened until the money's already gone.

On the Operator Mindset episode with Michael Hornby, founder of Techmentum, Michael described BEC as the single most expensive attack pattern he sees in small and midsize businesses. Seven-figure losses from single incidents. His characterization:

"They tend to sit in there and watch and study for as long as they can until they find that point where they think it's the right time to attack."

The five phases of a BEC attack

Compromise. Attacker gets into an email account — usually via stolen password, phishing capture, or token replay. No MFA required.
Persistence. Attacker sets up quiet mail forwarding rules that copy incoming (and often outgoing) emails to an external address they control.
Reconnaissance. Weeks or months of watching. Learning vendor names, invoice cycles, common signatures, who signs off on payments, when large transactions typically occur.
Trigger. A large invoice comes in — or is about to go out. The attacker intercepts, either modifying the incoming invoice's bank details or sending a fake "updated wiring instructions" email from the compromised account.
Extraction. Money goes to the fraudulent account. By the time anyone notices — often days later when the real vendor asks about payment — funds have been laundered through multiple accounts and international jurisdictions. Recovery rate is close to zero.

Why smart operators still fall for it

BEC doesn't look like an attack when it happens. The email that says "hey, please wire funds to this updated account" comes from your CFO's actual email address. The context is right. The tone is right. The timing is right. Everything is right except the destination account.

By the time the real CFO says "I never sent that," the wire has cleared.

The prevention stack

1. MFA on every account, no exceptions.

This is table stakes and it's still not universal. MFA blocks the credential-stuffing and stolen-password attacks that enable most BEC initial access.

2. Monthly forwarding rule audits.

Both admin-level and user-level. Look for rules forwarding to external addresses or auto-deleting inbound emails. Delete anything you don't recognize. Alert on new external forwarding rule creation.

3. Callback protocol for large payments.

Set a threshold. Above that threshold, any change to payment instructions requires a phone call to a known number — not the number in the email — to verify. This is a five-minute process cost that saves seven-figure losses.

4. Anomaly detection on login patterns.

Login from a new country. Login at 3am when the user never logs in at 3am. Multiple failed MFA attempts. Modern email security tools flag these automatically. Ensure the alerts actually reach a human who acts on them.

5. Employee training focused on BEC specifically.

Most phishing training focuses on the obvious phishing email. BEC training focuses on the emails that pass every filter and look exactly right — and the operational discipline (callback, verify, confirm) that catches them anyway.

What to do if you think you're compromised

Speed matters. Hours, not days. Michael's playbook:

Force password reset on the affected account and all admin accounts.
Revoke all active sessions across the compromised email platform.
Audit all forwarding rules and delete unfamiliar ones.
Notify your bank immediately if any wire has been sent in the last 72 hours — sometimes recall is possible within that window.
Report to the FBI IC3 (Internet Crime Complaint Center) — they occasionally recover funds if reported within 72 hours.
Contact your cyber insurance carrier before doing detailed forensics — many policies require insurer-approved forensics providers.

The bottom line

BEC is now the leading cause of catastrophic cyber losses at small and midsize businesses. It's cheap to defend against. It's cheap to detect. And it's expensive to ignore.

If you don't have MFA universally deployed and a callback protocol on large payments, you don't have BEC protection.