Business Email Compromise (BEC) attacks are one of the fastest growing and most costly forms of cybercrime affecting businesses today. Unlike traditional cyberattacks that rely on malware or system breaches, BEC scams exploit people’s trust among other factors.
Cybercriminals impersonate trusted suppliers, senior executives, or finance colleagues to trick businesses into transferring funds to fraudulent bank accounts. The request often looks routine, involving an invoice for payment, a change in bank details, or an urgent transfer that appears to come from management.
For finance teams and decision-makers in general, understanding how BEC attacks work and how to spot them early is critical to protecting business funds.
BEC attacks are frequently reported by financial institutions and regulators as a leading cause of corporate fraud losses worldwide.
How BEC attacks work & who they target
A Business Email Compromise attack is a form of social engineering where criminals use spoofed or compromised email accounts to deceive employees into making unauthorised payments.
These attacks typically target:
- Finance teams and accounts payable departments
- Employees authorised to approve payments
- Senior executives whose identities can be impersonated
Because these emails look legitimate and urgent, they blend seamlessly into normal workflows – no suspicious links or attachments, just convincing requests.
Common scenarios used in BEC scams
BEC scams usually follow familiar business workflows, such as:
- A supplier requesting updated bank details immediately after sending an invoice
- A senior manager asking for an urgent, confidential transfer
- A finance colleague requesting help processing a payment outside normal cycles
The goal is always the same: create pressure, bypass controls, and rush the victim into acting without proper verification.
Six red flags you can’t ignore
Recognising early warning signs is the best defense against BEC fraud. Here are 6 red flags every business and individual should watch out for:
- Incorrect email address: The email address may look legitimate, but small changes often reveal a fraudulent attempt. This may be extra or missing letters, misspelled domain names, and different top-level domains. Example: ‘@company-finance.com’ instead of ‘@companyfinance.com’.
- Sense of urgency: Scammers rely heavily on urgency and pressure to override caution. Watch out for emails containing phrases like “ASAP”, “Confidential”, and “this can’t wait”. Urgency is often used to discourage proper verification.
- Sudden changes to bank details: Requests to update bank details immediately after receiving an invoice are a major red flag, especially if there is pressure to act quickly.
- Use of unofficial channels: Payment instructions arriving via personal email accounts, messaging apps, or channels outside standard procedures should always raise concern.
- Unusual language and formatting: Poor grammar, odd phrasing, or email signatures that don’t match previous correspondence can indicate an impersonation.
- Senior management asking for “quick favours”: Emails that appear to come from executives or senior management requesting urgent payments without the standard procedures for approval are a classic BEC tactic.
Think and verify, before you pay
Whether it is urgent or not, before processing any payments or changing any details, take precautionary steps to properly verify.
- Verify the sender: Call the person or supplier using a trusted phone number, never the one provided in the email.
- Check bank details: Compare the account details against previous invoices and internal records.
- Apply the four-eyes principle: Always involve a second approver, regardless of how urgent it is.
A short delay to verify thoroughly can prevent significant financial loss.
Best practices for finance teams
If you’re directly involved with payments, here are some internal controls you can implement:
- Set clear thresholds to require two approvers for transfers over a specific amount
- Lock changes of supplier bank details with a vendor-verified form and phone verification
- Maintain a clean and organised supplier list, with which you can easily flag and review any changes
- Run regular reconciliations to spot anything that seems odd and suspicious before major losses escalate
What to do is you spot a BEC scam
Suspected a BEC scam? Act immediately with a few simple steps:
- Stop the payment and contact customer care or your bank
- Report the incident internally to your Security or Incident Response team
- Preserve the evidence by keeping the original email but do not reply, click on links, or forward it to anyone
- Escalate quickly if funds were transferred by contacting your bank’s fraud team and law enforcement
Acting swiftly when you spot such scams is imperative.
Your checklist before approving payments
Before authorising any payments or changes in details, ask yourself the below questions:
- Does the sender match what we have on file?
- Does this invoice look consistent with previous ones?
- Were any bank detail changes properly verified?
- Is this request outside standard payment policies or schedules?
- Has a second approver reviewed and approved?
Cybercriminals rarely break into systems first. They manipulate people by creating pressure, urgency, and fear of delaying business.
Those small actions can prevent costly mistakes, reputational damage, and uncomfortable conversations. Encourage your colleagues to stay vigilant and promote best practices to protect your organisation from BEC scams.
Our payment services are designed with security controls that help reduce the risk of fraud while keeping business operations running smoothly.
Moneybase Limited (C 87193) is licensed by the MFSA as a Financial Institution in terms of the Financial Institutions Act. Calamatta Cuschieri Investment Services Limited (C 13729) is licensed by the MFSA as an Investment Firm in terms of the Investment Services Act. Registered address situated at Level 0, Ewropa Business Centre, Dun Karm Street, Birkirkara, BKR 9034, Malta.
