Picture this. Your finance team receives an email from a supplier you have worked with for years. Same name, same signature, same writing style, replying in the same email thread about an invoice that is genuinely due. The only change: "Our bank details have been updated, please use the attached account for this payment."
The payment goes out. Weeks later, the real supplier calls asking why they haven't been paid. The money is gone.
This is business email compromise (BEC), and it works precisely because nothing about it looks like a "hack".
How the attack actually works
Step 1: Get into a mailbox
Attackers usually start with a phishing email that steals the password of someone at your company or at one of your suppliers. If that account has no multi-factor authentication (MFA), they log straight in.
Step 2: Watch quietly
They don't act immediately. They read emails for days or weeks, learning who approves payments, which invoices are due, how people write and when the CFO is travelling. Often they create hidden mailbox rules that forward or hide certain messages so the real owner doesn't notice.
Step 3: Strike at the right moment
When a large payment is due, they reply inside a real conversation, or from a look-alike domain, with "updated" bank details. Because the context is real, the request feels completely normal.
Common variations
- Supplier invoice fraud: a "supplier" announces new bank details.
- CEO fraud: an "executive" urgently asks for a confidential transfer, often while "in a meeting" and unreachable by phone.
- Payroll diversion: an "employee" asks HR to change the account their salary is paid into.
- Lawyer or deal fraud: fake instructions during an acquisition, property purchase or other time-sensitive deal.
Why smart people fall for it
BEC succeeds because it exploits trust and routine, not technical weakness. The emails are polite, well written and arrive in genuine threads. They target busy people at busy times: month-end, before holidays, during travel. And they often ask for secrecy or speed, which discourages the one thing that would stop them: a quick phone call.
Seven controls that stop it
- Call back on a known number before changing any bank details. Never use a phone number from the email asking for the change.
- Require two people to approve new or changed payee details and large transfers.
- Turn on MFA for every email account, especially finance, executives and IT administrators.
- Configure SPF, DKIM and DMARC on your domain so others cannot easily send email pretending to be you.
- Flag external emails and warn on look-alike domains in your email security settings.
- Monitor for suspicious mailbox rules and logins from unusual countries.
- Train finance, HR and executive assistants specifically; they are the people attackers target.
If it has already happened
- Call your bank immediately and ask them to recall or freeze the transfer. Speed matters more than anything else.
- Report it to the police and the relevant national cybersecurity authority.
- Secure the compromised mailbox: reset passwords, revoke active sessions, enable MFA and remove any rules the attacker created.
- Warn your suppliers or customers if their details may have been used.
How DABS helps
We test whether your email and cloud accounts can be taken over, run targeted phishing and vishing simulations against finance and leadership teams, and deliver focused payment-fraud awareness sessions in Arabic and English. Book a free call to see where your business is exposed.
