Business email compromise: how it works and how to stop it

The stock image is a panicked message in broken English demanding an urgent transfer. That is not what works. What works is boring.

A supplier you have worked with for four years writes to say their bank has changed. The message reuses the layout of their usual correspondence, your contact's signature, the reference of the outstanding invoice. The amount is right. The due date is in eight days. There is no artificial urgency: the urgency will arrive on its own, from the due date.

Your bookkeeper updates the bank details in the accounting system, because that is exactly what they do when a supplier changes bank. The transfer goes out for the right amount to the wrong account. Nobody notices anything until the real supplier chases, three weeks later.

The first is by far the commonest and the most profitable, because it needs no staging: knowing that an invoice exists is enough. It is also the one domain authentication helps most against, since it rests on imitating a known sender.

The precision of these messages always surprises. It comes from three sources, all mundane.

• Public information. Company registers, tenders, statutory notices, your own site, LinkedIn. Who runs it, who signs, who invoices whom.
• A compromised mailbox, yours or your supplier's. The fraudster then reads real exchanges for weeks before writing a word. It is the most expensive scenario and the hardest to spot.
• A data leak. A mislaid invoice, a resold customer file, a reused password.

This is the part software vendors explain badly, because it limits what they sell. There are three ways to pass for you, and they are not addressed the same way.

Exact spoofing is the cheapest of the three: no domain purchase, no waiting, no stolen password. Removing it with DMARC at rejection pushes the fraudster onto slower, costlier and far more visible methods. The other two belong to monitoring and attention.

The only factor that matters is time. A transfer can sometimes be recalled while it is still unexecuted; once the funds are withdrawn they are effectively unrecoverable.

1. Call your bank immediately, by telephone, and ask for the transfer to be recalled. Not an email, not a message in the online banking portal.
2. Do the same with the receiving bank if you have its details: freezing the account is their decision.
3. Keep everything: the original message with full headers, the exchanges, the transfer records. The headers are what will let the attack be characterised.
4. Report it to the police. A report is needed for insurance and for any civil action.
5. Warn the impersonated supplier: if they are being used against you, they are being used against their other customers.
6. Have your mailboxes checked: password changes, two-factor authentication, and above all an inspection of recently created mail rules.

1. The call back on the known number. Every change of bank details is confirmed by telephone, on the number already in your records, never the one given in the message. It is free, it takes two minutes, and it stops nearly every case.
2. Dual approval above a threshold. Two people for any transfer above an amount you set. The fraudster then has to convince two people who talk to each other.
3. DMARC at rejection. Removes exact spoofing of your domain, and gives you daily visibility of attempts.
4. Two-factor authentication on every mailbox. With no convenience exemption for the directors, who are precisely the target.
5. Short, concrete awareness training. Centred on the display name and the cousin domain, since those are the two cases the technical controls let through.

The order is by cost-effectiveness. The first two cost nothing but a decision, and they cover more than any software does.

No DNS record stops a message from a cousin domain, a homoglyph or a misleading display name, and none stops a message sent from a genuinely compromised mailbox. The fraud can also arrive by telephone or by post: the destination account does not change.

That is why the call-back rule heads the list of countermeasures rather than trailing it: it is the only one that covers every channel at once, including the ones no configuration can see.