What the term actually covers
Business email compromise, often shortened to BEC, isn't one specific trick. It describes any scam that relies on a believable business email rather than malware. The email might come from a hacked account inside your company, a hacked account at a supplier or customer, or a lookalike address designed to pass a quick glance. The goal is almost always money, though some attacks are after payroll records, client lists or tax details.
What makes BEC different from ordinary spam is the research. Attackers often sit quietly in a compromised mailbox for days or weeks, reading conversations and learning who approves payments, when invoices go out and how people sign off their emails. When they finally act, the message fits perfectly into an existing thread.
How attackers get into a mailbox
The usual starting point is a stolen password. A staff member receives a message asking them to sign in to view a shared document, and the sign-in page is a convincing fake. Once the attacker has the password, they log in from overseas. If the account has no multi-factor sign-in, that's all it takes. Reused passwords leaked from other websites are another common route.
Once inside, attackers often create hidden inbox rules. A typical rule moves any email containing words like 'invoice', 'payment' or 'bank' into an obscure folder, or forwards copies to an outside address. That lets them watch the money conversations and stop the real owner seeing replies to their fraudulent messages. Finding unexpected rules is one of the clearest signs a mailbox has been taken over.
The common BEC scenarios
The most frequent version in NZ small business is invoice fraud: a supplier's mailbox is hacked and the attacker asks customers to pay a new account. Close behind is impersonation of a senior person, where someone pretending to be the owner asks a staff member to make an urgent payment or buy gift cards. Payroll diversion is another, where a fake request asks HR to change an employee's bank account before pay day. Property settlements, law firm trust accounts and builders' progress payments are attractive because they involve large single transfers. But BEC isn't limited to big amounts. Many attacks target a few thousand dollars at a time, small enough that nobody escalates the question before paying.
The controls that make the biggest difference
Turn on multi-factor sign-in for every mailbox, including shared and admin accounts, and block older sign-in methods that skip it. This single step defeats most password-theft attacks. Then add alerting so someone is told about sign-ins from unusual countries, new forwarding rules and mass deletions. Microsoft 365 and Google Workspace both have these features, though some depend on your licence level, so check what your plan includes.
Pair the technical controls with a process rule. Any request involving money, bank details, payroll changes or bulk personal data is confirmed outside email, by phone to a known number or in person. Make sure the rule covers the boss, because impersonation of senior people is one of the most effective BEC tactics.
What to do if you suspect a compromise
Reset the account's password from a clean device, sign the user out of all sessions, and check that multi-factor sign-in is on and that no unfamiliar methods have been added. Look for inbox rules and forwarding you didn't create and remove them. Check the sent items for messages the user didn't write, because those people may need a warning.
If money has moved, call the bank first, then report it to the police and the NCSC. If personal information may have been seen, consider your obligations under the Privacy Act 2020, which requires notifiable breaches to be reported to the Privacy Commissioner. Keep a record of what you found and when, since it will help with any insurance claim or investigation.
Why small offices are a favourite target
Attackers don't need a big company to make BEC worthwhile. A ten-person office paying suppliers, receiving deposits or handling client trust money moves enough money each month to be interesting, and it usually has fewer checks than a corporate finance team. Many small offices also share passwords, skip multi-factor sign-in on older accounts, or let one person both set up and pay suppliers.
There is also less chance of anyone noticing. Without someone reviewing sign-in logs or mailbox rules, an attacker can sit inside a mailbox for weeks. The aim of good protection is not to make you impossible to attack, just harder and slower than the next business, and quick to spot when something is wrong.
In short
- BEC is fraud using a real or fake business mailbox, not malware.
- Most compromises start with a stolen password and no multi-factor sign-in.
- Hidden inbox rules and forwarding are a key warning sign.
- Confirm any money or bank-detail request outside email.
- Act fast: bank first, then reset, then report.