An invoice arrives from a familiar vendor. An executive asks for a payment approval, or a protected Microsoft message appears to contain a document your finance team needs to review. Each request looks like the work accounts payable teams, controllers, and CFOs handle every day.
That familiarity gives Business Email Compromise (BEC) much of its power. ProtectMyIT defines BEC as an email-based attack that uses deception and impersonation to obtain sensitive information or funds, often by posing as an executive, vendor, or other trusted contact.
Business Email Compromise Fits Into Normal Finance Work
BEC rarely needs an unusual premise. Finance teams already process invoices, approve payments, review vendor changes, exchange sensitive documents, and respond to requests from people with authority to move money.
An attacker can imitate those interactions and alter one critical detail. New banking instructions, an unexpected wire request, a document requiring another login, or a sudden change in the normal approval process can turn a familiar task into an opportunity for fraud.
