Business Email Compromise (BEC) is a simple and highly effective form of cyber-attack because it exploits human trust rather than technical vulnerabilities.

In its basic form, it’s an email scam that is designed to trick employees, often into handing over money, secrets, or data, but the primary goal of a BEC is evolving with its tactics.

Increasingly, the threat actor has their sight set on more than just those quick wins – they’re after your digital identity, the master key to your organisation’s crown jewels.

How BEC Attacks Start: When Your Login Becomes Their Master Key

After years in the cybersecurity trenches, I’ve seen threats evolve in incredible ways. We spend so much time defending ourselves against complex, sophisticated attacks that we often miss the glaring vulnerability right in front of our faces: our own email.

This might be an unpopular opinion, but I firmly believe that if your email is compromised, it’s potentially game over for your digital identity. And the data backs me up. A recent 2024 report on trends in cybersecurity revealed that business email compromise (BEC) is now the number one-way criminals target organisations.

Think about that. Not some zero-day exploit, but a simple, deceptive email. The report found a staggering 70% of businesses were targeted in these attacks last year.

This isn’t a future threat. It’s happening right now. It’s time we stopped treating our emails as just a communication tool and started seeing it for what it is: an entry point to our entire digital lives.

Why Business Email Compromise Attacks Are So Effective

What makes BEC attacks so successful? It’s because attackers have shifted their focus from exploiting software to exploiting human nature – a mind-boggling 90% of all cyber threats now rely on social engineering.

In a BEC scam, a threat actor gets into a legitimate email account and simply pretends to be someone else. They’ll impersonate an executive to trick the finance department into wiring money, or pose as a vendor with a “new” invoice.

They aren’t hacking systems; they’re hacking our trust. And a compromised email account is the perfect platform to launch this kind of attack. This is especially true when the email is believable, well-constructed, and may be related current business activities that can be harvested from other data on the Internet.

5 Common Tactics Used in Business Email Compromise (BEC)

Your email address is the most reused component of almost all your identity. Once an attacker is inside your inbox, they have an incredible amount of power. Here are the most common tactics they use to exploit you, as the human reader:

1) Exploiting Email-Based Two-Factor Authentication (2FA)

Most modern solutions allow you to select a source for 2FA, including your mobile phone and email address. Let me be blunt: using your email to receive two-factor authentication codes is a terrible idea. If an attacker has your email password, your “second factor” is delivered right to them. It provides a false sense of security while doing almost nothing to stop a breach.

2) Abusing Password Reset Features (“Forgot Password” Backdoor)

This convenient feature becomes an attacker’s best friend. With access to your email, they can go to your bank, your cloud storage, or your social media and simply click “Forget Password”. They intercept the reset link, lock you out, and take over. I recommend placing several layers of security around password resets including using “Security Questions” or third-party authenticators to prevent rogue passwords resets.

3) Setting Up Malicious Email Forwarding Rules

One of the sneakiest tricks I see is email forwarding.

A savvy attacker won’t make a lot of noise. Instead, they’ll log in, go to email settings and create a rule to forward every single email you receive to an address of their control. They get a real-time copy of everything, and you might not notice for months using the basic features built into your email service.

Some email services, like aol.com, have removed this feature due to the rampant abuse by threat actors—but needless to say, they are just of one of many providers, and almost all, to date, still allow this configuration for easy abuse.

4) Silent Email Monitoring for Long-Term Access

A threat actor’s persistent presence in an email account is a surprisingly trivial yet effective tactic. By simply logging in and monitoring your communications, they gain a persistent yet stealthy view of all activity. This is less flashy than other attacks, like spoofing 2FA or automatically forwarding all emails, but its goal is to allow the threat actor to observe, learn, and slowly execute their mission.

This patient approach can allow for long-term monitoring—sometimes for years—as long as the password remains unchanged.

This is why it is always important to check which devices have authorised access to your mailbox.

5) Impersonating the Victim’s Identity Through Their Inbox

This is the heart of BEC. Attackers can send and delete emails as you. They can send a fake invoice to a client or a fraudulent wire request to your boss, then delete the evidence from your “Sent” folder. To the recipient, the request is coming from a trusted source—you—and the receiver simply doesn’t know any better regarding the sender’s intent.

How to Protect Against Business Email Compromise

Protecting your email is about adopting smarter habits.

Here is my personal, must-do list for every person I advise, Use your email for:

Correspondence Only: Emails are designed to send and receive information, not to store it securely for the long term. Stop using your inbox as a permanent file cabinet for sensitive documents like tax returns. Anything confidential shouldn’t be sitting in your email archives. Clean out your “Sent” and “Deleted” folders periodically to minimise your long-term data exposure.

Never Use Email For 2FA: If a service offers 2FA, that’s great. But always choose an authenticator app (like Google Authenticator or Okta) or a physical security key for identity verification.

Put an Alarm on the Front Door by Using MFA: Your email must be protected by multi-factor authentication, especially when you’re accessing your account from a new device or location. This is different than 2FA and should use an application, mobile device, or other physical media. Tie your security to something you have, not just another password you know.

Stop Using Your Email as a Username: If a third-party application lets you choose a unique username that isn’t your email address, do it. This makes it harder for attackers to connect the dots if one of your accounts is compromised in another company’s data breach since usernames cannot be as easily linked as email addresses especially when each one is unique.

Practice Password Hygiene: Your email password should be unique, long, complex, and used nowhere else. A password manager is the best tool for this. Reusing passwords is the digital equivalent of leaving your car keys on the front seat and not locking the door.

Protecting Your Email Means Protecting Your Identity

My final piece of advice is this: Start treating your email account with the same care you would your car keys or your wallet. Because in today’s digital world, it’s infinitely more valuable and far more dangerous in the wrong hands.

Don’t wait until a compromised inbox turns into a full-scale breach. Take our Identity Security Risk Assessment to see where your organisation is most vulnerable.

Recommended reading

• Survey: Fear of Mobile App Security Neglect Rises by 258%
• Report: For British Consumers, Mobile App Security Is Important
• What Clear Trends Are Emerging For Cybersecurity in 2025?

Frequently Asked Questions (FAQ)

What is Business Email Compromise?

Business Email Compromise (BEC) is a type of cybercrime where a threat actor gains access to a legitimate business email account and uses it to deceive and defraud others. It’s highly effective because it exploits human trust rather than technical vulnerabilities.

What is the difference between BEC and phishing?

A phishing email is typically broad and malware-based, while a Business Email Compromise (BEC) attack is highly targeted, using social engineering and impersonation of trusted individuals to trick victims into transferring money or sensitive information.

What are common tactics used in a BEC attack?

Attackers may exploit weak email-based 2FA, abuse “Forgot Password” reset links, set up malicious forwarding rules, silently monitor inboxes, or impersonate the victim’s identity to defraud others.