Business Email Compromise
Business email compromise is often treated as a financial fraud problem, distinct from information security incidents. In regulated professional environments, that distinction does not hold. BEC events are typically the downstream result of compromised authentication combined with insufficient authorization controls. The harm arises not merely from deception, but from systems that permit sensitive actions based on email trust alone.
In a typical BEC scenario, an attacker gains access to a legitimate mailbox or convincingly impersonates one. The mechanics vary, but the objective is consistent: exploit established workflows to induce action. Payment instructions, document requests, changes to account details, and internal approvals are targeted precisely because they are routine and time-sensitive. From an evaluative standpoint, the question is not whether the request looked plausible, but whether reliance on email as an authorization mechanism was appropriate given the risk.
Post-incident analysis tends to focus on whether email communications were permitted to initiate or approve sensitive actions without independent verification. Where financial transfers, disclosure of client information, or changes to standing instructions can be executed based solely on an email message, the control environment is treated as permissive by design. Training may reduce error rates, but it does not convert email into a secure authorization channel.
Access scope again becomes central. When a compromised mailbox provides visibility into client records, billing systems, or internal correspondence beyond what is strictly necessary, the impact of BEC expands rapidly. Investigators often examine whether mailbox access was segmented, whether forwarding rules were monitored, and whether anomalous access patterns were detectable. The absence of such constraints tends to shift findings from isolated fraud toward systemic control failure.
BEC incidents are also evaluated in terms of recoverability and traceability. Practices are asked whether they can determine what information was accessed, what instructions were sent, and over what period compromise persisted. Where logging is limited or retained briefly, uncertainty becomes a driver of notification and response obligations. In these cases, inability to establish scope is treated as a risk outcome in its own right.
A common error is to frame BEC as an unavoidable byproduct of modern communication. That framing understates its predictability. The technique relies on well-understood weaknesses, implicit trust in email identity, lack of secondary verification, and permissive access once authenticated. None of these are obscure. When they coexist, exploitation is foreseeable.
For regulated professionals, the relevance of BEC lies in how authority is delegated within systems. Email is an efficient communication tool, but it is a weak control boundary. Practices are not expected to eliminate deception, but they are expected to recognize where deception could result in irreversible action and to design safeguards accordingly. Whether that expectation was met is typically assessed only after funds are transferred or information is disclosed.
Some practices mitigate this risk through informal verification habits and experience. Others formalize controls as transaction volume, client sensitivity, or regulatory exposure increases. In either case, BEC incidents are evaluated less on the sophistication of the attacker than on whether the practice’s authorization model made misuse likely.