SarangThe FBI Internet Crime Complaint Centre (IC3) 2024 Annual Report, states that BEC scams resulted in worldwide losses approaching $2.8 billion over a one-year period, during which more than 21,000 people filed complaints.
The situation in India shows an equally dangerous threat. The Indian Computer Emergency Response Team (CERT-In) has detected a significant increase in business email compromise fraud, which specifically targets financial teams of small and medium enterprises and export-import organisations.
The guide explains BEC, the most common types of BEC attacks targeting Indian businesses, and how to detect them, while outlining the essential steps to protect your organisation.
Mitigata – Your Complete Cyber Resilience Partner
Most BEC attacks slip through because security and compliance are handled in silos. Fixing that usually means stitching together multiple vendors, tools, and processes, which rarely works smoothly.
Mitigata brings all of this under one roof, so you’re not juggling different systems when it matters most.
- Email security where it matters most – Protection tailored for Google Workspace and Microsoft 365, the primary targets for BEC attacks.
- One place for security, compliance, and insurance – Everything works together, so your controls, policies, and financial coverage aren’t disconnected.
- Better tools without inflated costs – Access to enterprise-grade solutions at rates that actually make sense for growing teams.
- Built with compliance in mind – Security measures that also support frameworks like ISO 27001, instead of treating compliance as an afterthought.
- Used by 800+ businesses across India – Teams that needed practical protection, not just another dashboard.
Fix Email Security Gaps Across Your Stack
Secure Google Workspace and Microsoft 365 with Mitigata at better pricing.
What is BEC in Cyber Security?
Business Email Compromise attacks are targeted social engineering attacks in which cybercriminals use compromised or spoofed business email accounts to trick employees, vendors, and partners into sending money and sensitive data to their control.
Three characteristics make BEC uniquely dangerous:
- No malware or malicious links: emails look completely clean
- Highly targeted: attackers research the organisation, its people, and its processes
- Exploits human trust: employees act on authority, urgency, and familiarity
Because BEC emails use authentic-looking domain names and send no attachments, traditional spam filters and antivirus systems fail to detect them. The FBI considers business email compromise fraud the most expensive internet crime because criminals deceive people through their advanced psychological tactics, not because the crime requires technical expertise.
Not all compliance partners deliver results. Here’s what sets the top CERT-In companies apart from the rest.
How a BEC Attack Works: Step-by-Step
Understanding the BEC attack lifecycle is the first step toward effective BEC attack detection. A typical attack unfolds in five stages:
- Reconnaissance – The attackers analyse the company’s LinkedIn page, press releases, and social media accounts to find information about its executives, finance staff, and vendor partnerships.
- Account Compromise or Spoofing – Two methods: either compromising a real email account through credential phishing, or registering lookalike domains (acme-lndia.com instead of acme-india.com) that appear legitimate at a glance.
- Building Trust – The attack will take several weeks to begin. Attackers silently read emails to understand ongoing transactions, payment schedules, and the tone of the emails.
- The Strike – The procedure requires that a single email message containing a payment change request, a wire transfer request, and a sensitive HR data request be sent with appropriate timing and urgency, using strict confidentiality measures.
- Funds Redirection – Money is transferred to an attacker-controlled account and immediately moved to a mule account, to a different jurisdiction, or converted to cryptocurrency. Recovery after this stage is rare.
One Partner for Security, Compliance, and Insurance
Mitigata aligns protection, policies, and coverage without juggling multiple vendors.
Types of Business Email Compromise Attacks
The FBI officially recognises six BEC variants. Indian businesses must understand all six, each requires a different defensive response.
1. CEO Fraud
An attacker impersonates a C-suite executive, typically the CEO or CFO and pressures a finance employee to make an urgent wire transfer. The email usually requires recipients to maintain confidentiality until the wire transfer is complete, thereby allowing the attacker to evade detection.
It’s common during board meetings or travel periods, when executives are perceived as unavailable for direct verification.
2. Vendor Email Compromise (VEC)
Vendor email compromise is one of the fastest-growing BEC subtypes in India. Attackers gain access to a genuine supplier’s email account or create convincing email impostors to join existing invoice discussions, where they secretly modify bank payment information to direct payments to their fraudulent accounts. The victim pays the invoice, believing they are settling a legitimate debt.
Exporters and importers transacting regularly with overseas vendors via email are particularly exposed. The high volume of legitimate payment instructions creates cover for fraudulent account change requests.
3. Invoice Fraud
Accounts payable teams receive fake invoices that include real purchase order numbers obtained by hackers through reconnaissance. The invoice appears exactly like authentic supplier invoices, but its payment information directs payments to the attacker.
SMEs with manual invoice processing and limited cross-referencing between purchase orders and payments are the primary target.
Choosing between tools or ecosystems? This breakdown of Microsoft 365 vs Google Workspace reveals what most teams overlook.
4. Account Takeover (EAC – Email Account Compromise)
Attackers gain full access to an employee’s real email account through credential phishing. The attackers use the compromised account to monitor all email communication and create forwarding rules that will capture payment-related messages and initiate additional business email compromise attacks against the victim’s business partners and clients.
Every email sent from a compromised real account passes DMARC, SPF, and DKIM checks. No technical control catches it. Only behavioural anomalies such as unusual login locations, inbox rule creation, and off-hours access provide detection signals.
5. Payroll Diversion
HR or payroll teams receive an email that appears to be from an employee requesting a change to their salary bank account. The variant targets organisations that maintain extensive workforces while operating decentralised HR systems, and it has become a common issue in India’s IT and BPO industries.
6.Attorney/Legal Counsel Impersonation
Attackers impersonate lawyers or legal representatives handling sensitive matters such as mergers, acquisitions, litigation, regulatory filings, and request urgent, confidential fund transfers or document submissions. The legal authority framing discourages employees from seeking verification.
Quick Comparison: Types of BEC Attacks
The following table shows the comparison between the types of Business Email Compromise attacks:
| Type of Attack | Primary Target | Goal |
|---|---|---|
| CEO Fraud | Finance / Accounts team | Urgent wire transfer |
| Vendor Email Compromise | Accounts payable | Payment redirection |
| Invoice Fraud | Finance / Procurement | Fake invoice payment |
| Account Takeover (EAC) | Any employee | Data theft + further fraud |
| Payroll Diversion | HR / Payroll teams | Salary account hijack |
| Attorney Impersonation | Finance / Legal / Executive | Confidential transfer |
Built for Teams Tired of Fragmented Security
Mitigata replaces scattered tools with one connected cyber resilience approach.
Why BEC Is Rising Rapidly in India
India’s digital economy is one of the fastest-growing in the world, and this growth has made it a prime target for BEC actors. Several structural factors are accelerating the threat:
- Rapid UPI and digital payment adoption have normalised remote financial approvals with minimal verification
- SMEs and export businesses frequently transact via email with overseas vendors, creating abundant impersonation opportunities
- Widespread gaps in email authentication since many Indian businesses still lack properly configured SPF, DKIM, and DMARC records
- Low security awareness among non-IT employees, who remain the primary target of social engineering
- A 1,760% year-on-year increase in BEC volume has been linked to the rise of generative AI tools that produce perfectly written, culturally localised fraud emails
The financial sector, pharmaceutical exporters, IT services firms, and government-adjacent businesses are among the highest-risk segments in India today.
Most SaaS founders underestimate risk exposure until it’s too late. This guide on cyber insurance for SaaS explains why.
BEC Attack Detection: Warning Signs Every Employee Must Know
Effective BEC attack detection requires both technical controls and trained human vigilance. Here are the red flags every employee should know:
Email-level warning signs
- Slight domain variations: vendor@acme-india.com vs vendor@acme-lndia.com
- Unusual sender display names that do not match the actual email address
- Requests to change payment account details, even from a known contact
- Urgency combined with requests for secrecy (‘Do not forward this to anyone’)
- Emails sent outside normal working hours or from a mobile device are unexpectedly
Process-level warning signs
- A payment request bypassing the standard approval workflow
- Invoice amounts slightly below approval thresholds to avoid scrutiny
- Salary change requests submitted without a formal HR portal entry
- A vendor proactively ‘updating’ bank details without a prior request
The core detection challenge is that BEC emails carry no malware signatures or suspicious links and often pass DMARC checks, either because the organisation has not enforced DMARC strictly or because the attacker has compromised a real account. This is why business email compromise protection must combine technology and process, not technology alone.
They may look similar, but the impact is very different. Understand the real gap in spoofing vs phishing attacks.
How to Prevent Business Email Compromise: A Layered Framework
The given table outlines a layered prevention framework for Business Email Compromise:
| Layer | Action |
|---|---|
| Human | Regular BEC awareness training for finance, HR, and procurement teams |
| Technology | Deploy AI-powered email security with behavioural analysis and DMARC enforcement |
| Process | Mandatory out-of-band verification for any payment account change or wire transfer |
| Governance | Enforce dual-approval for transactions above defined thresholds |
| Monitoring | Continuous mailbox monitoring for inbox rule changes and forwarding anomalies |
The most impactful steps to prevent BEC attacks are:
- The organisation should implement phishing-resistant Multi-Factor Authentication (MFA) across all business email accounts, which includes their executive and financial staff.
- The organisation needs to establish DMARC authentication with ‘p=reject’ policy implementation, which requires SPF and DKIM authentication mechanisms to prevent domain spoofing attempts.
- Establish a strong out-of-band verification rule: all changes to payment details must be confirmed by a known telephone number, not through replying to an email requesting the change.
- The organisation should conduct training sessions for all staff members using BEC simulation exercises. Your most affordable protection method relies on building security awareness among your personnel.
- Verify any modifications made in a bank account directly with the respective vendor relationship managers, not email contacts.
Security That Actually Works With Your Compliance
Mitigata helps align ISO 27001 efforts with real-world threat protection.
Business Email Compromise Protection: What to Look for in a Solution
For organisations that need to move beyond awareness and into active defence, the right business email compromise protection platform should deliver:
- AI-powered behavioural analysis that understands normal communication patterns and flags deviations even with no malware present
- Real-time BEC attack detection with automated quarantine capabilities before a fraudulent email reaches the inbox
- DMARC/DKIM/SPF enforcement and domain lookalike monitoring
- Account takeover detection alerting on suspicious login anomalies and unexpected inbox rule creation
- Integration with Microsoft 365 and Google Workspace without disrupting existing workflows
- Vendor relationship mapping, identifying when a trusted supplier’s email shows unusual behaviour
Modern BEC emails, which use AI to generate content that traditional Secure Email Gateways (SEGs) fail to detect. The shift must be toward intent-aware, context-driven security architectures.
Conclusion
Business Email Compromise is not a phishing email your spam filter will catch. The attack targets your organisation’s trust, which it has developed with its employees, vendors and partners through a methodical approach that seeks to achieve financial gain. For Indian businesses navigating rapid digital growth, the risk is acute, and the cost of a single successful attack can be catastrophic.
Mitigata helps Indian organisations implement enterprise-grade business email compromise protection through advanced AI-driven detection, proactive threat monitoring, DMARC enforcement, and tailored security strategies built for the Indian business environment.
Talk to experts and assess your BEC risk before attackers do.
Frequently Asked Questions (FAQs)
1. What is BEC in cybersecurity?
BEC in cybersecurity is a targeted social engineering attack in which cybercriminals compromise or spoof a legitimate business email account to deceive employees into transferring money or sharing sensitive data. Unlike phishing, BEC requires no malware; it exploits human trust and organisational processes.
2. What are the main types of BEC attacks?
The five main types of BEC attacks are: CEO Fraud (executive impersonation for wire transfers), Vendor Email Compromise (supplier impersonation to redirect payments), Invoice Fraud (fake invoices sent to accounts payable), Account Takeover (real account compromised for deeper access), and Payroll Diversion (redirecting employee salaries to fraudulent accounts).
3. What is vendor email compromise?
Vendor email compromise (VEC) is a BEC subtype where attackers compromise or convincingly spoof a trusted supplier’s email account. They insert themselves into active invoice threads and silently change the bank account details, causing the victim company to pay a legitimate invoice to a fraudulent account.
4. How to prevent business email compromise?
To prevent business email compromise: enforce phishing-resistant MFA on all accounts; implement DMARC, DKIM, and SPF email authentication; establish out-of-band verification for all payment account changes; train employees regularly with simulated BEC scenarios; monitor mailboxes for unexpected forwarding rules; and deploy AI-powered email security.
5. How to prevent BEC attacks when they bypass spam filters?
BEC attack prevention requires behavioural AI tools that flag anomalies in communication patterns, strict process controls (dual-approval for payments, mandatory phone verification for account changes), and continuous employee awareness training.
6. Why is BEC attack detection so difficult?
BEC attack detection is challenging because these emails contain no malicious links, attachments, or known malware signatures. They often pass DMARC and SPF checks either because the attacker uses a compromised real account or because the target organisation has not enforced email authentication. Detection requires context-aware security tools and trained human judgment working together.
7. What should I do if my organisation experiences a BEC attack?
If you suspect a BEC attack: immediately contact your bank to freeze or recall any wire transfer; isolate the compromised email account and reset credentials; alert your IT security team and conduct a full mailbox audit to identify forwarding rules and report the incident to CERT-In (India).
deepthi s
areena g
akshit k