What is business email compromise (BEC)?

What is business email compromise (BEC)?

Business email compromise (BEC) is a type of social engineering attack that takes place over email. In a BEC attack, an attacker falsifies an email message to trick the victim into performing some action — most often, transferring money to an account or location the attacker controls. BEC attacks differ from other types of email-based attacks in a couple of key areas:

1. They do not contain malware, malicious links, or email attachments
2. They target specific individuals within organizations
3. They are personalized to the intended victim and often involve advance research of the organization in question

BEC attacks are particularly dangerous because they do not contain malware, malicious links, dangerous email attachments, or other elements an email security filter might identify. Emails used in a BEC attack typically contain nothing but text, which helps attackers camouflage them within normal email traffic.