Business Email Compromise: How CEO and Invoice Fraud Works

The short answer

Business Email Compromise (BEC) is fraud in which an attacker poses as an executive, supplier or partner and persuades an employee to send money to the wrong account. These emails often carry no malware or links, so spam filters let them through. The attack targets the payment process and trust, not technology.

The main defense is not software but a rule: any payment to new or changed bank details is confirmed through an independent channel and approved by a second person.

How it works

The attacker needs a believable reason and an address people will trust. Options include:

• a lookalike domain off by one character: company-uz.com instead of company.uz;
• a free email account with the CEO's name in the sender field;
• a genuinely compromised mailbox of an employee or supplier — the most dangerous case, since the message lands in an existing thread;
• a spoofed Reply-To so the answer goes to the fraudster.

Before attacking, criminals research the company: website, social media, news, who the CEO is, who handles accounting, which suppliers you use.

Typical scripts

The "CEO" email. "I'm in a meeting and can't talk. We need to pay a partner invoice urgently, details below. Keep this quiet for now, the deal is confidential."

Supplier bank change. "We've switched banks, please pay the current invoice to the new details." It often comes from the real supplier's hacked mailbox, right in the thread about a real order.

Fake invoice. An invoice that looks genuine, from a familiar contractor, but with a different beneficiary account.

The "lawyer" or "auditor". A message from an outside adviser supposedly handling a secret transaction.

Data request. Instead of money, they ask for payroll data or employee documents to use in later attacks.

Red flags

• Urgency and pressure: "by end of day", "or the deal falls through".
• A request for secrecy and bypassing the usual process.
• New bank details, especially in another country or for a different legal entity.
• The executive is "unreachable by phone" though they normally answer.
• The sender or Reply-To address differs from the usual one, even by a single character.
• Unusual tone, greeting or signature.
• An amount just below the threshold that triggers extra approval.

Payment verification procedure

Give accounting a written procedure:

1. Callback. Any bank detail change is confirmed by calling a number from the contract or company directory, never one from the email.
2. Four-eyes principle. Payments to new details or above a set amount need a second approver.
3. Vendor master file. Supplier details live in a separate register and change only after verification.
4. Urgency is no reason to skip checks. Leadership states in advance and publicly: "I will never ask you to bypass the procedure."
5. Hold on new details. The first payment to a new account goes out only after confirmation, even if that delays it.
6. Fast escalation. Staff know whom to ask about a suspicious email and are not afraid to "bother" the CEO.

Technical measures

Process matters most, but technology cuts the number of attempts:

• 2FA on every mailbox so they are harder to take over;
• SPF, DKIM and DMARC for your domain, making it harder to spoof mail in your name;
• tagging external emails in the mail client;
• alerts on new forwarding rules — attackers often create them to read correspondence;
• registering lookalike domains if your brand is frequently impersonated.

If the money has already gone

• Contact your bank immediately and ask it to recall or freeze the payment: speed matters.
• Report to law enforcement.
• Check mailboxes for compromise: change passwords, review forwarding rules and active sessions.
• Warn the supplier if the attack used their name.