Ransomware gets the headlines, but the attack that quietly takes the most money from small businesses involves no malware, no encryption, and often no hacking at all. Business email compromise (BEC) is, at its core, one move: convince someone with payment authority to send money to the wrong place. The FBI’s fraud statistics have put BEC losses in the billions per year, year after year — more than ransomware — precisely because it’s cheap to run and hard for technology alone to stop. Here’s how it works, and the two rules that defeat it.
The core mechanic: persuasion, not intrusion
A BEC attack succeeds the moment a real, authorized person willingly sends a real payment — to an account the attacker controls. Nothing “breaks in.” That’s why firewalls and antivirus barely factor: the malicious payload is a sentence, something like “please update our remittance details before the next payment.”
Attackers get into position two ways. The cruder path is impersonation: a lookalike domain (yourvendor-inc.com) or a spoofed display name, dressed up with details scraped from LinkedIn and your website. The far more dangerous path is a genuinely compromised mailbox — a phished password (here’s how those emails work) on an account without MFA. From inside a real mailbox, the attacker reads quietly for weeks: who invoices whom, for how much, in what tone, on what schedule. They set a hidden forwarding rule so they see replies. Then they pick their moment — a real invoice, a real project, a real relationship — and change only the bank account. Everything about the email is authentic except where the money goes.
The five variants aimed at businesses like yours
- Vendor payment redirect. The workhorse. “Our banking details have changed” from a supplier you actually owe — often a real invoice, intercepted and altered. Frequently discovered only when the genuine vendor calls about the unpaid bill, weeks later.
- Executive impersonation (“CEO fraud”). An urgent request from the boss — a wire, a “confidential acquisition,” gift cards for client gifts — timed for when the executive is known to be traveling and unreachable. (More on this variant.)
- Payroll diversion. “HR” receives an employee’s request to update direct deposit. The paycheck lands in the attacker’s account; the employee finds out on payday.
- Attorney/escrow pressure. Fake counsel or title company, urgent and confidential, aimed wherever large one-time transfers happen — real estate closings above all.
- The client/customer version. Attackers impersonate you to the people who pay you, redirecting your receivables. Your own email authentication (SPF, DKIM, DMARC) is what makes your domain hard to counterfeit.
The common threads: money in motion, urgency, and a plausible reason not to verify (“in a meeting,” “confidential,” “the deadline is today”). The pressure to skip verification is the attack.
The defense: two rules and some technology
The good news about BEC is that the defense is genuinely simple — it’s a process, and it costs almost nothing:
Rule 1: Any new or changed payment instruction is verified by phone, at a number you already have on file. Not the number in the email — you’d be calling the attacker. From a prior invoice, your contacts, or the official website. No exceptions for urgency, seniority, or how legitimate the email looks — especially not those.
Rule 2: Transfers above a threshold you choose take two people. Fraud that has to fool two humans, one of whom is following Rule 1, mostly stops being attempted.
Write both down, train them, and — critically — make it culturally safe to slow down. The employee who calls to double-check the CEO’s “urgent” wire is doing their job perfectly, and everyone should hear leadership say so before the day it matters.
Behind the process, the technology that shrinks the attack surface: MFA on every mailbox (this single control prevents most mailbox takeovers), advanced filtering that flags lookalike domains, alerts on new forwarding rules and unusual sign-ins (attackers’ first moves inside a mailbox), and recurring awareness training so finance and admin staff — the most-targeted people in the building — recognize the setup.
If money already moved
Speed decides everything. Call your bank immediately and ask them to attempt a recall and contact the receiving bank — funds are sometimes recoverable in the first hours, rarely after a few days. Report it the same day at ic3.gov; the FBI’s recovery team has clawed back real money when notified fast. Notify your cyber insurer promptly (and check your policy’s social-engineering sublimit before you need it — these losses are often capped surprisingly low). Then assume a mailbox is compromised until proven otherwise: reset credentials, hunt for forwarding rules, and review sign-in logs.
The bottom line
BEC is the most expensive attack on small businesses because it targets the one system that can’t be patched: trust between people who move money. Two written verification rules, MFA on email, and a culture where double-checking is praised will defeat the vast majority of it — which makes this the rare billion-dollar threat with a nearly free defense.