Last updated: 7 November 2026
Business email compromise (BEC) is fraud where an attacker takes over, or convincingly imitates, a real mailbox to trick staff into paying a fake invoice or changing bank details. Stop it with multi-factor authentication, email authentication (SPF, DKIM and DMARC), a mandatory phone call-back before any bank-detail change, and alerts for hidden mailbox rules.
How a typical BEC attack unfolds
Your defences, layer by layer
| Defence | Stops | Effort |
|---|---|---|
| Multi-factor authentication | Takeover with a stolen password | Low |
| SPF, DKIM and DMARC | Criminals spoofing your domain to your customers | Low |
| Call-back rule for bank detail changes | Fake supplier and fake CEO requests | Low |
| Mailbox rule and sign-in alerts | Hidden forwarding used to watch and hijack threads | Medium |
| Awareness training and simulations | Staff clicking the first phishing link | Medium |
Warning signs staff can spot
- A change of bank details, even from a known supplier, by email only
- Urgency or secrecy: “pay today, don’t tell anyone”
- A reply-to address or domain that is one letter off
- A request from a senior person who is normally on leave or abroad
- An invoice thread that suddenly changes tone mid-conversation
How ABCOM helps
We enforce MFA, set up and monitor SPF, DKIM and DMARC, filter malicious email, and detect suspicious sign-ins and mailbox rules (see What is ITDR?). Our free email hijack guide and spam filtering guide go further.
Quick answers
What should we do if we have already paid a fake invoice?
Phone your bank immediately and ask them to recall the payment, then report it to Action Fraud and tell your IT provider so mailboxes can be checked and secured. The faster you act, the better the chance of recovery.
What is DMARC and do we need it?
DMARC tells receiving mail servers what to do with email that fails authentication for your domain. It stops criminals sending convincing emails that appear to come from you, and major mailbox providers now expect it.
Worried about invoice fraud or email spoofing? We can check your domain protection for free.
Related answers and guides
- What is MFA?
- What is ITDR?
- What is user awareness training?
- How can staff spot a phishing email?
- Free email hijack guide
- All ABCOM FAQs
Sources and further reading
Related questions
Want this sorted for you?
Talk to our Burgess Hill team about cyber security services. Free, friendly and no obligation.