Email is essential for invoices, supplier communication, internal approvals and customer enquiries. Unfortunately, that also makes business email a valuable target for cybercriminals.
Business email compromise in Australia can involve attackers impersonating executives, employees, suppliers or trusted partners to convince someone to transfer money, reveal sensitive information or change payment details.
Understanding the warning signs can help businesses respond before an email scam becomes a financial incident.
What Is Business Email Compromise?
Business email compromise, commonly known as BEC, is a form of targeted email fraud.
The attacker may:
- Compromise a genuine email account
- Impersonate an executive
- Pretend to be a supplier
- Register a similar-looking email domain
- Send fraudulent payment instructions
Unlike obvious spam, BEC messages are often designed to look like normal business communication.
This makes them particularly difficult to identify if employees rely only on spelling mistakes or unusual formatting as warning signs.
Common Types of BEC Attacks
Invoice Fraud
An attacker pretends to be a supplier and asks the business to send future payments to a different bank account.
The request may appear inside an existing email conversation or imitate the supplier’s normal communication style.
Executive Impersonation
An employee receives an urgent request that appears to come from a director, manager or senior executive.
The message may ask for:
- A payment
- Gift cards
- Sensitive information
- Account credentials
- Immediate action without normal approval
Compromised Employee Account
If an attacker gains access to a real employee’s mailbox, they may read previous conversations and send convincing messages from the legitimate account.
This can make the attack much harder to detect.
Supplier Impersonation
Attackers may study business relationships and pretend to be an external supplier, accountant, consultant or service provider.
The goal is usually to redirect money or obtain information.
8 Warning Signs of Business Email Compromise
1. A Sudden Change in Bank Details
Payment-detail changes should always be treated carefully.
A request to send money to a new account should be independently verified using trusted contact information already held by the business.
2. Unusual Urgency
BEC messages often create pressure.
Examples include:
- “This needs to be paid immediately.”
- “I’m in a meeting, don’t call.”
- “Process this before the end of the day.”
Urgency is designed to make employees skip normal verification procedures.
3. Requests to Bypass Normal Processes
Be cautious when someone asks you to ignore established approval or payment procedures.
A legitimate executive should not need staff to weaken security controls for convenience.
4. Slightly Different Email Addresses
Some attackers use domains that look almost identical to a trusted company address.
Employees should check the full sender address rather than relying only on the display name.
5. Unexpected Payment Requests
A payment request may appear convincing but still be unusual for the sender.
Consider whether the request matches that person’s normal responsibilities and communication style.
6. Suspicious Login Notifications
Unexpected Microsoft 365 or email login alerts can indicate that someone is trying to access an account.
These alerts should be investigated rather than ignored.
7. New Email Forwarding Rules
Attackers who gain access to a mailbox may create forwarding or inbox rules to monitor messages or hide responses.
Unexpected rules should be investigated promptly.
8. Requests for Confidential Information
BEC is not always about money.
Attackers may request:
- Employee data
- Customer information
- Payroll details
- Tax information
- Login credentials
Sensitive information should never be released solely because an email appears to come from a familiar person.
How Can Businesses Reduce BEC Risk?
Use Multi-Factor Authentication
MFA provides an additional barrier if an employee password is stolen.
It should be applied broadly, particularly to privileged accounts.
Protect Microsoft 365 Accounts
Businesses should review:
- Sign-in policies
- Administrator permissions
- External forwarding
- Suspicious login monitoring
- Conditional Access
- Legacy authentication
A secure email environment requires more than simply changing passwords.
Create Payment Verification Procedures
Businesses should establish a clear process for:
- New bank accounts
- Payment-detail changes
- High-value transactions
- Urgent payment requests
Staff should verify unusual requests using a trusted phone number or another independent communication method.
Train Employees
Employees should understand that modern phishing emails can be professionally written and highly convincing.
Training should focus on behaviour and context rather than obvious spelling mistakes.
Reduce Excessive Access
Users should only have access to the systems and information required for their role.
Limiting access can reduce the impact of a compromised account.
What Should You Do If You Suspect BEC?
Act quickly.
Recommended initial steps may include:
- Contacting your IT or cybersecurity team
- Securing affected accounts
- Reviewing recent sign-ins
- Checking email forwarding rules
- Preserving relevant evidence
- Contacting the financial institution quickly if money was transferred
- Reviewing whether other accounts may also be affected
Do not simply delete suspicious emails and assume the issue is resolved.
Why BEC Is a Business Risk, Not Just an IT Problem
Business email compromise involves people, processes and technology.
Even a technically secure environment can remain vulnerable if payment approvals can be changed through a single email.
Cybersecurity controls should therefore work alongside financial and operational procedures.
Email Security Support in Melbourne
CyberXera helps businesses improve email and Microsoft 365 security, strengthen access controls and review suspicious activity.
If you have received a suspicious payment request or believe an account may have been compromised, early investigation can help determine the appropriate next steps.
Frequently Asked Questions
What does BEC stand for?
BEC stands for Business Email Compromise, a form of fraud involving impersonation or compromised business email accounts.
Is business email compromise the same as phishing?
BEC can involve phishing, but it is usually more targeted and focused on impersonation, payments or sensitive business information.
Can MFA prevent business email compromise?
MFA can significantly strengthen account protection, but businesses should also use email security controls, monitoring and verification procedures.
How do I verify a request to change supplier bank details?
Use contact information you already trust and confirm the change through an independent channel rather than replying directly to the email.
What should I do if an employee email account is compromised?
Secure the account quickly, investigate recent activity and determine whether other users, payments or business systems may also be affected.
Strengthen Your Email Security
Email fraud can look like normal business communication.
CyberXera can help assess your email environment and identify practical ways to strengthen Microsoft 365 security, phishing protection and account monitoring.
Contact CyberXera to discuss email security support for your business.
