Business Email Compromise
CriticalEmail & Social Engineering
Also known as: BEC, CEO fraud, Invoice fraud
Attackers hijack or impersonate a trusted email account to redirect payments and steal funds.
What it is
Business Email Compromise is a targeted scam in which an attacker gains access to, or convincingly impersonates, a legitimate business email account, then uses it to trick staff, customers or suppliers into transferring money or sensitive data. It is one of the most financially damaging cyber crimes for Australian businesses because it exploits trust and normal business processes rather than technical flaws.
How it works
- 1
The attacker compromises an email account (often via phishing) or registers a look-alike domain.
- 2
They quietly monitor the mailbox to learn payment cycles, tone, contacts and invoices.
- 3
At the right moment they send a message, for example a "new bank account" for an expected supplier invoice, or an urgent payment request from the "CEO".
- 4
Inbox rules are often created to hide replies and warnings from the real account owner.
- 5
Funds are transferred to the attacker and quickly moved on, making recovery difficult.
Warning signs
- Last-minute changes to bank account or payment details
- Urgent, secretive payment requests from executives
- Slightly altered email domains (for example .co instead of .com.au)
- Unexpected mailbox rules that move or delete incoming mail
- Suppliers chasing invoices you believe were already paid
Business impact
- Direct and often unrecoverable financial loss
- Fraudulent payments made to attacker-controlled accounts
- Damaged relationships with suppliers and customers
- Exposure of confidential financial information
How to defend against it
Verify payment changes independently
Always confirm new or changed bank details by phone using a previously known number before paying.
Protect email with MFA and monitoring
MFA prevents most account takeovers, and alerting on new inbox rules or unusual logins catches compromise early.
Set clear payment approval controls
Require dual approval for payments over a threshold and for any change to payee details.
Lock down your domain
DMARC enforcement and look-alike domain monitoring reduce impersonation of your business.
Measure your defences
Use these free Cyber Toolkit tools to check how exposed you are and close the gaps this threat exploits.
Ready to strengthen your protection?
Book a free security check and we'll show you where your business stands clear next steps, no jargon, no obligation.
If you are unable to reach us by phone, please email and a member of our team will respond promptly.
Or explore our free security tools — 30+ scanners, checkers and assessments, free with an account.