In short
BEC fraud (Business Email Compromise) is an email scam where someone poses as a vendor, an executive or a client to get a payment or data. It needs no virus or link: a credible, urgent message is enough. It's prevented by combining domain authentication (SPF, DKIM and DMARC), a filter that analyzes the context of each message, and an internal process to verify any change to bank details.
What BEC fraud is
BEC stands for Business Email Compromise. The attacker studies the company, identifies who pays invoices or who can authorize a transfer, and writes to them pretending to be someone trusted.
Unlike bulk phishing, it doesn't target thousands of people: it targets one, with a message written just for them.
The most common forms
- Fake invoice from a vendor. "We changed banks, please pay this invoice to the new account."
- Manager impersonation. An urgent, confidential payment request, supposedly from the general manager, while they're traveling.
- Compromised vendor. The attacker gets into a vendor's real inbox and replies inside a genuine conversation. See conversation hijacking.
- Fake lawyer or advisor. A supposed lawyer asks for a transfer "for a confidential matter."
- Payroll account change. An email to HR, in a worker's name, asking to deposit their salary into another account.
Why traditional filters don't catch it
A BEC email usually has no links or attachments, is well written, and sometimes comes from a real account. To a rule-based filter like SpamAssassin, it looks like a normal email. We explain this in detail in why SpamAssassin doesn't catch targeted phishing.
Warning signs
- A request to change bank details, even from a known vendor.
- Urgency and requests for secrecy: "don't mention this, I need it done today."
- A domain with one letter changed or a different suffix than usual.
- The reply address (Reply-To) differs from the sender's.
- A sender who has never written to that person before.
- Timing or writing style that's unusual for that person.
How to prevent it
On the mail server:
- Set up SPF, DKIM and DMARC on all your domains, so no one can send mail using exactly your domain.
- Use a filter that detects BEC and impersonation by analyzing the context of each message, not just its content. That's what Clisec for cPanel servers does.
- Visibly flag mail coming from outside the organization.
In your processes:
- Verify any change to bank details by phone, calling a number you already have, never the one in the email.
- Require a second approval for payments outside the norm.
- Explain these signs to your finance, purchasing and HR teams.
What to do if it already happened
- Call your bank immediately to try to stop or reverse the transfer. The first hours matter most.
- If an email account was compromised, change its password, turn on two-factor authentication, and check for forwarding rules you didn't create.
- Keep the original emails with their full headers.
- File a report with the PDI (Cybercrime Investigation Unit) or Carabineros.
- Notify the impersonated person or vendor, so they can review their own security.
Frequently asked questions
Is BEC fraud the same as phishing?
It's a type of targeted phishing. The difference is that BEC aims for a payment or business data, and often uses no links or files: just a convincing message.
Does an antispam filter stop BEC fraud?
A filter based on generic rules usually doesn't, because the message doesn't look like spam. You need a filter that analyzes context: who's writing, from which domain, and what they're asking for.
Does DMARC prevent BEC fraud?
It prevents someone from impersonating exactly your domain, which is an important step. It doesn't prevent look-alike domains or attacks from genuinely compromised third-party accounts.
Protect every account on your server from BEC fraud
Clisec detects targeted phishing, impersonation and BEC fraud in incoming mail across your whole cPanel server, without changing MX records.