What it is
Business email compromise (BEC) targets the way organisations pay money. An attacker gains access to, or convincingly imitates, the email of a supplier, a senior manager or a colleague, then requests a payment or asks to change bank details. The message looks legitimate because it comes from a real or near-identical address, so the payment is sent to the attacker.
How it works
An invoice arrives with new bank or mobile-money details, supposedly from a known supplier.
A manager appears to send an urgent, confidential request to move money, often while travelling.
A lookalike domain swaps or adds a character so the address reads correctly at a glance.
The attacker may have read real email threads first, so the tone and timing feel normal.
How to protect your organisation
Make one rule non-negotiable: any change to payment details, and any unusual or urgent payment, is confirmed with the supplier or colleague using an established phone number before money moves. Require a second person to approve significant transfers, protect every email account with multi-factor authentication, and train staff to pause on payment requests. See staff awareness and BEC and securing email.
If a payment has been sent
Contact your bank or mobile-money provider immediately to try to stop or recall the payment.
Secure the affected email account: change the password, sign out other sessions and review forwarding rules the attacker may have added.
Preserve the emails and transaction details, tell leadership, and report through our reporting guidance.
Useful references
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.