Attack Guide
Business Email Compromise (BEC): How Invoice Fraud Works
Answer: Business Email Compromise (BEC) is a phishing attack where criminals impersonate executives, employees, or vendors to trick your organization into transferring money or changing payment details. BEC attacks rose approximately 15% in 2025 and remain one of the highest-loss fraud types reported to the FBI.
How does a BEC attack work?
- The attacker researches the target organization using public information, social media, and prior data breaches.
- They spoof or compromise an executive\'s or vendor\'s email account to send a fraudulent message.
- The email requests an urgent wire transfer, invoice payment, or bank detail change — often with a plausible pretext.
- Some attacks use "conversation hijacking," where the attacker inserts themselves into a genuine email thread using a lookalike domain.
- Multi-persona impersonation creates fake email chains where two or more "parties" appear to discuss a payment, making the request seem legitimate.
- If the victim complies, funds are transferred to an attacker-controlled account, often overseas and difficult to recover.
Sources: FBI IC3, Trustwave SpiderLabs (2025), Palo Alto Networks, Hoxhunt Cyber Threat Intelligence Report 2025.
What are the warning signs of BEC?
- Urgent or time-sensitive requests for wire transfers or gift card purchases
- Requests to change vendor bank account details for an "outstanding invoice"
- Emails from lookalike domains (e.g., micros0ft.com instead of microsoft.com)
- Executive impersonation asking an employee to buy gift cards or process a payment
- Fake email threads where multiple "personas" appear to discuss a payment
- Instructions to keep the request confidential or bypass normal approval procedures
What should you do if you receive a suspicious payment request?
- Do not act on the payment request or bank detail change based on the email alone.
- Verify the request through a separate, trusted channel — call the vendor or executive using a number you already know.
- Compare the sender's email domain carefully against the legitimate domain.
- Check for lookalike domains by examining every character of the email address.
- Report the email to your IT or security team and to your email provider's phishing-report option.
- Scan the email text or screenshot with PhishGlass for an AI-assisted risk assessment.
How does PhishGlass detect BEC?
PhishGlass analyzes the full content of suspicious emails and messages. For BEC, it checks for:
- Urgency and pressure tactics in payment or bank-detail-change requests
- Lookalike domain detection (homoglyph and character substitution)
- Executive or vendor impersonation patterns
- Conversation hijacking indicators in email threads
- Social-engineering cues designed to bypass normal approval procedures