Business Email Compromise, commonly known as BEC, is a category of social-engineering attacks that targets trusted business relationships to obtain money or sensitive information.<\/p>\n
An attacker may impersonate an executive, accountant, supplier or business partner. The message is often designed to look like an ordinary business request.<\/p>\n
A dangerous aspect of BEC is that the message may contain no malicious attachment or link at all. The attack may rely entirely on social engineering.<\/p>\n
Critical payment instructions should be verified through a second channel, employees should understand phishing and spoofing, and mailbox security should be monitored.<\/p>\n
Some BEC incidents use a legitimate employee mailbox that has already been compromised, making fraudulent messages much more convincing.<\/p>\n