Business email compromise

Business email compromise (BEC) usually involves no malware at all. The attacker either impersonates someone the victim trusts, using a lookalike domain or a spoofed display name, or takes over a real mailbox after stealing its credentials. Then they ask for something that looks routine: change the bank details for an invoice, pay an urgent supplier, buy gift cards for the CEO, send the employee tax forms.

Because the messages contain no malicious links or attachments, they often pass email filters. The FBI's Internet Crime Complaint Center consistently ranks BEC among the costliest types of cybercrime reported to it.

Example

An attacker compromises a supplier's mailbox and quietly reads the threads with your accounts payable team for two weeks. When an invoice is due, they reply in the same thread with "updated" bank details. The email comes from the real supplier address, so nothing looks wrong, and the payment goes to the attacker's account.

Why it matters for a SOC analyst

BEC investigations live in identity and mailbox logs: unusual sign-ins, new inbox rules that hide replies, mail forwarding to external addresses, and messages sent from unfamiliar IP addresses. The single most effective control is procedural rather than technical: any change to payment details must be confirmed through a known phone number, never by replying to the email that requested it.