Ransomware gets the headlines because it is loud. Business email compromise, or BEC, stays quiet, and year after year it steals more money. No malware, no locked screens. Just an email that convinces someone to send a payment to the wrong place.
The classic version: an attacker gets into a real mailbox, yours or a vendor’s, and watches. They learn who pays whom, how invoices look, when payments go out. Then one day an invoice arrives that looks exactly right, except the bank account number has changed. The money leaves, and nobody notices for weeks.
The defenses that actually stop it
- Verify every banking change by phone. Call the vendor at a number you already had on file, never one from the email. This single habit defeats most BEC cold.
- Protect the mailboxes themselves. Strong MFA and alerts for suspicious mailbox rules. Attackers love creating hidden rules that forward or delete mail to cover their tracks.
- Separate approval from request. The person who requests a payment should not be the only person who can approve it. Small businesses skip this because everyone trusts each other. The process is not about trust, it is about verification.
- Talk about it openly. Staff who know this scam exists catch it. The story above sounds obvious once you have heard it, which is exactly why telling it matters.
Want us to check whether your mailboxes have quiet forwarding rules right now? Book a free consultation. It takes minutes to look and it has surprised more than one business owner.