Business email compromise: how invoice fraud actually works

Ransomware gets the headlines. Business email compromise gets the money. BEC uses no malware and trips no antivirus — just a convincing email and a bank account that quietly changes. It's the attack that drains municipal accounts and small-business payrolls without ever "breaking in."

The anatomy

1. Access or impersonation. The attacker either gets into a real mailbox (a phished password, no MFA) or spoofs a trusted sender — a vendor, an executive, a title company.
2. Patience. From inside a real inbox, they read. They learn who pays whom, the tone people use, the timing of invoices.
3. The switch. At the right moment, a real-looking invoice arrives with new "updated" bank details — or the "CEO" urgently asks for a wire.
4. The wire clears before anyone calls to confirm.

Why it beats technical defenses

There's no payload to detect. The email is often sent from a legitimate, compromised account. Everything looks normal because, mechanically, it is — the fraud is in the intent, not the code.

What actually stops it

• MFA on email — removes the easiest path to a real mailbox.
• A hard out-of-band rule: any change to payment details is verified by a phone call to a known number, never a number in the email.
• Advanced email filtering that flags look-alike domains and first-time senders.
• Awareness training so "the invoice changed" triggers a call, not a payment.

Watch our live threat feed for the campaigns hitting the region now.