Quick Answer 

Fraud carried out by email, usually without malware or malicious links. The attacker impersonates someone trusted — a supplier, an executive, a client — and asks for a payment, a change of bank details, or information. Because the request looks routine, it often works.

Why Technology Struggles to Stop It

A BEC email frequently contains nothing to detect. No attachment, no link, no forged domain. Some are sent from a genuinely compromised supplier mailbox, which means every authentication check passes because the email really is from them.

Filtering catches what looks malicious. A polite message about updated banking details doesn't.

The Common Patterns

• Supplier bank detail change — the most costly, and the most convincing, because it references real invoices

• Executive request — urgent transfer or gift card purchase, framed so the recipient won't want to question it

• Payroll diversion — an employee's bank details changed before payday

• Invoice fraud — a legitimate-looking invoice for work that references a real project

Verification Procedures Are the Defence

The control that actually works costs nothing: any change to bank details, and any unusual payment request, gets verified by phone on a number you already hold. Not the number in the email. Not by replying to it.

Make it a rule rather than a judgement call, so nobody has to decide whether this particular request feels odd enough. Staff also need to know they won't be criticised for slowing down a payment to check.

Supporting Controls

MFA on email limits how often your own accounts get compromised and used against your clients. SPF, DKIM, and DMARC stop your domain being forged. Impersonation detection catches lookalike domains. Training helps staff recognise the patterns. All of it supports the verification step rather than replacing it.

Example Scenario 

A 90-person construction company received an email appearing to come from a long-standing supplier, requesting updated banking details for future invoices. It referenced recent projects and read naturally. Finance followed the verification procedure, called the supplier on a known number, and learned no change had been requested.

How PureStack Reduces Your BEC Risk

We secure your email and identity controls, deploy impersonation detection, train staff on the patterns, and help you put verification procedures around payments — the step that stops the attacks technology can't.