Business Email Compromise (BEC) is consistently one of the highest-cost cybercrime categories reported to the Australian Cyber Security Centre. Unlike ransomware, which announces itself dramatically, BEC attacks are quiet, patient, and by the time anyone notices, the money is already gone. The average BEC loss per incident dwarfs most ransomware demands — because the attacker is not asking for a ransom, they are stealing directly.
How BEC Attacks Work
BEC attacks fall into two broad categories: account takeover and impersonation.
Account Takeover BEC
In an account takeover, the attacker gains legitimate access to a real email account — typically through a phishing attack, credential stuffing, or an AiTM attack. They then monitor the mailbox for weeks, learning the victim's communication patterns, current supplier relationships, pending transactions, and the names of key contacts.
When an opportunity presents itself — say, a large invoice payment is being discussed — the attacker intercepts the thread and inserts themselves, redirecting the payment to a fraudulent account. Because the email comes from the real account of a real person, it passes every technical spam and sender verification check. There is nothing for a filter to catch.
Impersonation BEC
Impersonation attacks don't require account access. The attacker registers a domain that closely resembles a trusted company and sends emails that appear to come from a trusted supplier, executive, or partner. Combined with information gathered from LinkedIn and the company website, these emails can be alarmingly convincing. Common scenarios include a "CEO" emailing the accounts team with an urgent bank transfer request, or a "supplier" notifying accounts payable of a change in bank details ahead of a large payment.
Why BEC Is So Hard to Stop with Technology Alone
Email security tools — even excellent ones — struggle with account takeover BEC because the email is genuinely from a legitimate account, with no malware attachment, no suspicious link, and a valid sending domain. The content looks like a normal business email. Traditional spam filtering simply has nothing to act on. Impersonation BEC can be partially addressed by DMARC, DKIM, and SPF records, which make it harder to spoof your own domain. But these records only protect your domain from being impersonated — they don't prevent a visually similar lookalike domain from being used against you.
Technical Defences That Help
DMARC, DKIM, and SPF
Every Australian business should have SPF, DKIM, and DMARC configured for their email domain. SPF specifies which mail servers are authorised to send email from your domain. DKIM adds a cryptographic signature to outbound emails. DMARC tells receiving mail servers what to do when an email fails these checks. A DMARC policy of p=reject ensures spoofed emails using your domain are rejected outright by recipients' mail servers.
Multi-Factor Authentication on Email
MFA on Microsoft 365 directly reduces the risk of account takeover BEC. If attackers can't get into a mailbox, they can't conduct the reconnaissance that makes account takeover BEC so effective. This is the single most impactful technical control.
Conditional Access and Anomalous Login Detection
Microsoft Entra ID can detect and block suspicious logins — such as an account suddenly signing in from a different country — and flag them for review. Configuring these policies and reviewing sign-in logs regularly can catch account takeovers before they are exploited for BEC.
Email Signatures as a Defence
Centralised email signatures can include security notices on outbound emails — for instance, "Our bank details never change. If you receive an email claiming otherwise, call us on [number]." This simple addition can prevent payment redirection scams even after all technical controls have failed.
Process Controls Are Just as Important
No technical control can fully substitute for good processes around financial transactions. The most effective safeguards against BEC are procedural:
- Verify bank account changes by phone — call the supplier on their known number (not any number in the email) to confirm before changing payment details.
- Dual approval for large payments — require two staff members to authorise any payment above a threshold.
- Security awareness training — staff who understand how BEC works are far less likely to act on fraudulent payment requests without verification.
Key Takeaways
- BEC is one of the most financially damaging cyber threats in Australia, with losses often far exceeding ransomware demands.
- Account takeover BEC bypasses all technical email filters because the email comes from a legitimate, trusted account.
- DMARC, DKIM, and SPF protect your domain from being spoofed — they are essential but not a complete solution.
- Phone verification of bank account changes is the single most effective safeguard against payment redirection fraud.