Business Email Compromise: How Wire Fraud Actually Happens
A plain-language walkthrough of how attackers turn a single compromised inbox into a six-figure wire transfer, and how to stop it.
Business email compromise, or BEC, is one of the most expensive threats facing small businesses today. It does not rely on malware or sophisticated tooling. It relies on patience, observation, and a single compromised inbox.
A typical scenario looks like this. An employee falls for a phishing page and enters their email password. The attacker quietly logs in, sets up an inbox rule that hides certain messages, and reads months of email traffic. They learn how the company talks, who approves wires, and which vendors are due to be paid. When the timing is right, they send a message that looks completely normal, asking for a small change in banking details. The wire goes out. By the time anyone notices, the money is gone.
The controls that actually prevent BEC are unglamorous but effective:
- Enforce phishing-resistant MFA on every mailbox, not just admins.
- Configure SPF, DKIM, and DMARC so attackers cannot easily spoof your domain.
- Block or alert on suspicious inbox rules, especially rules that auto-delete or forward messages.
- Require voice verification on any change to payment instructions, no exceptions.
- Train finance and executive assistants on the specific patterns BEC uses.
- Monitor sign-in activity for impossible travel, unusual locations, and legacy protocol use.
- Keep an incident response contact handy so a suspected compromise gets triaged in hours, not days.
BEC is one of the few threats where a single conversation can save a business hundreds of thousands of dollars. Realm Defense helps small businesses tighten email security, run tabletop exercises, and put verification workflows in place. Schedule a security review to walk through your current setup.