Business Email Compromise: How Wire Fraud Actually Happens (and How to Stop It)
Business email compromise, or BEC, is one of the most expensive attacks a small business can face — and it rarely involves any malware at all. There is no virus to catch, no ransomware screen, no obvious break-in. Instead, an attacker convinces a real person to send a real payment to the wrong bank account. By the time anyone notices, the money is usually gone.
We see this hit businesses across every industry, and the losses are often five or six figures. Here is exactly how it works, why your spam filter does not catch it, and the handful of controls that actually stop it.
How a BEC attack actually unfolds
The attacker's goal is simple: get someone with access to money to move it. They get there through impersonation and patience, not brute force. A typical playbook looks like this:
- They study you first. Attackers read your website, LinkedIn, and public records to learn who your executives are, who handles payments, and who your vendors are.
- They gain a foothold or fake one. Sometimes they phish an employee's Microsoft 365 password and log into a real mailbox. Other times they simply register a look-alike domain — swapping an rn for an m, or using a .co instead of a .com.
- They wait and watch. If they are inside a real mailbox, they read email quietly, learn your invoicing language and timing, and set up hidden rules to hide their own replies.
- They strike at the right moment. A fake email from the “CEO” asks accounting to wire funds urgently for a confidential deal. Or a “vendor” emails updated banking details right before a large invoice is due.
Why your spam filter misses it
Traditional spam and antivirus tools look for bad links, malicious attachments, and known-bad senders. A BEC message has none of those. It is a plain, well-written email — often from a legitimate but compromised account, or from a domain that looks almost identical to a real one. There is nothing technically “malicious” to detect. The attack targets human trust and routine, which is exactly why process matters more than any single filter.
The two flavors you will see most
- CEO fraud: an urgent, hush-hush request from a senior leader pressuring a staff member to move money fast and stay quiet about it.
- Vendor email compromise: a trusted supplier — or someone posing as one — sends “updated” payment or banking information. This one is dangerous because the invoice and the relationship are completely real.
How to actually stop it
The good news is that BEC is very preventable with a layered approach. No single control is enough on its own, but together these close the door:
- Build a payment-verification process and never skip it. Any change to banking details, and any wire over a set dollar amount, must be verified by a phone call to a known number — not a number from the email. Make this a firm rule, not a suggestion.
- Turn on multi-factor authentication everywhere. MFA on Microsoft 365 stops most mailbox takeovers cold. If an attacker cannot log in, they cannot lurk inside your email.
- Deploy SPF, DKIM, and DMARC. These email-authentication records make it far harder for someone to spoof your domain. Proper DMARC setup on Microsoft 365 tells the world which servers are allowed to send as you — and rejects the rest.
- Train your people to slow down. Urgency and secrecy are the two biggest red flags. Staff should feel completely safe pausing a payment to double-check, even when the “boss” is pushing.
- Watch for mailbox tampering. Hidden forwarding rules and logins from strange locations are early warning signs a good monitoring setup will catch.
If money moves in your business by email, you are already a target. The businesses that avoid BEC losses are not the ones with the fanciest tools — they are the ones with a verification habit that everyone follows, backed by solid email security. Our cybersecurity services cover exactly this: email authentication, MFA, monitoring, and staff training built around how your business really pays and gets paid.
Equal Tech Solutions helps businesses in Chattanooga, Cleveland, and across the Southeast US shut down wire and invoice fraud before it costs them. If you want an honest look at where your payment process is exposed, contact Equal Tech Solutions and we will walk through it with you.
