Business email compromise (BEC) is a fraud in which an attacker impersonates a supplier, executive or colleague by email to redirect a legitimate payment to an account they control. It usually involves no malware and no malicious link, which is why email security tools often pass it through. Stopping it requires a combination of email authentication, impersonation controls and finance verification procedures.
Key Takeaways
- BEC carries no payload — there is frequently nothing for a gateway to detect.
- The most costly variant is supplier impersonation, not CEO fraud.
- DMARC enforcement stops exact-domain spoofing but not lookalike domains.
- The decisive control is a finance verification procedure for any change to payment details.
- Speed of response matters: recovery is sometimes possible if the bank is contacted within hours.
How the attack actually works
Most BEC follows one of three patterns:
- Supplier impersonation. The attacker registers a lookalike domain, or compromises a real supplier mailbox, and emails your accounts payable team with updated bank details for an invoice that genuinely exists. This is the most expensive variant because the invoice is real and expected.
- Executive impersonation. A message appearing to come from the CEO or CFO instructs a finance team member to make an urgent confidential payment. It relies on hierarchy and time pressure rather than technical sophistication.
- Internal account takeover. An attacker gains access to a real mailbox in your organisation, watches payment conversations, and intervenes at the right moment from a genuine internal address.
The third is the hardest to detect, because the email is authentically from your domain, from a real colleague, in an existing thread. Mailbox rules that hide replies are a common fingerprint — the attacker auto-files responses so the real employee never notices the conversation.
Why email security alone does not stop it
Gateways are built to detect malicious content: attachments, links, known-bad infrastructure. A BEC email contains a plausible business request in plain text. There is no payload to analyse.
Lookalike domains compound the problem. A domain registered yesterday has no reputation history, which means it has no bad reputation either. If it passes SPF, DKIM and DMARC for its own domain — which it will, because the attacker configured it correctly — the authentication checks pass.
What does help is tuning the controls most tenants leave at default: display-name impersonation protection, external-sender warnings, lookalike domain detection and first-contact flags. Our enterprise email security work usually finds these either disabled or untuned, and managed email security keeps them tuned against live campaigns rather than set once at deployment.
The technical controls that matter
- Enforce DMARC. Move from p=none to p=reject with correct SPF and DKIM. This stops exact spoofing of your own domain against customers, suppliers and staff. Stage it carefully — enforcing too early blocks legitimate third-party senders.
- Tune impersonation protection. Protect executive display names and your own domain variants, and apply visible warnings rather than silent quarantine so users see the signal.
- Monitor lookalike domain registrations. Attackers register the domain before they use it. Brand and domain protection catches that window and gets the domain taken down.
- Watch for mailbox rule creation. Rules that forward or hide messages are a strong account-takeover indicator and should alert in your monitoring.
- Harden identity. Phishing-resistant MFA and conditional access limit the account takeover that enables the worst variant. See our Microsoft Entra ID security work for Microsoft estates.
The finance control that stops the loss
Every technical control above reduces the probability of the email arriving. One procedural control reduces the probability of the money leaving.
Any change to supplier bank details is verified by callback to a known number — never a number in the email, and never by replying to the thread.
That single rule, applied without exception, defeats every BEC variant described above. The difficulty is organisational rather than technical: it must apply to urgent requests, to requests from executives, and to long-standing suppliers, because those are precisely the conditions attackers engineer.
Supporting elements: a maintained list of verified supplier contacts, dual authorisation above a defined threshold, and a stated policy that nobody will ever be penalised for delaying a payment to verify it.
What to do when it happens
- Contact the bank immediately and request a recall. Recovery chances drop sharply after the first hours, and sometimes within the first day.
- Preserve evidence. Full email headers, the message itself, and mailbox audit logs before anything is deleted.
- Check for account compromise. Review mailbox rules, sign-in logs and session activity. If an internal mailbox was involved, treat it as an intrusion — our incident response and digital forensics team handles this as a security incident, not a finance error.
- Report it to the relevant UAE authorities and, where personal data was exposed, assess PDPL notification obligations.
- Take down the infrastructure. Lookalike domains and fake profiles used in the attack can be removed — see fraud prevention and takedown.
Frequently Asked Questions
What is business email compromise?
BEC is a fraud in which an attacker impersonates a supplier, executive or colleague by email to redirect a legitimate payment to an account they control. It typically contains no malware or malicious link, which is why conventional email security often does not block it.
Why do email filters miss BEC?
Because there is nothing malicious to detect. The message is plain business text from a domain with no bad reputation, correctly authenticated for that domain. Filters look for malicious content and known-bad infrastructure, and a well-built BEC email has neither.
Does DMARC stop business email compromise?
It stops exact spoofing of your own domain, which is one attack path. It does not stop lookalike domains, which authenticate correctly for themselves, and it does not stop a compromised real mailbox. DMARC is necessary but not sufficient.
What is the single most effective control?
A mandatory callback verification on any change to payment details, using a phone number you already hold rather than one supplied in the email. Applied without exception, it defeats every common BEC variant regardless of how convincing the message is.
Can money lost to BEC be recovered?
Sometimes, if the bank is contacted very quickly. Funds are typically moved onward within hours, so recovery chances fall sharply with delay. Contacting the bank should happen before internal investigation, not after it.
Which UAE sectors are targeted most?
Any sector with high-value supplier payments — construction, logistics, trading, real estate and professional services see heavy targeting. The common factor is routine large transfers to external accounts rather than the industry itself.
Talk to a UAE Cybersecurity Team
Cybersecurity MEA helps UAE organisations close BEC exposure across all three layers: email security engineering, domain monitoring and takedowns, and awareness training that reflects the pretexts actually being used against your sector. Talk to us if a payment request has already looked wrong.