Business email compromise: what it is and how to stop it

Why spam filters miss it

Most spam filters look for bad links, bad attachments and senders with a bad history. A BEC message usually has none of these. It is a short, polite note from a free mail account or a fresh domain, and the only thing wrong with it is the name at the top.

That name is what the reader trusts. When "Pat Jones" asks for a quick favor, people want to help their CEO, so they reply before they look at the address.

The common forms

The urgent request from an executive

The attacker uses the CEO's or owner's name and asks someone in finance for a wire transfer or gift cards. The message often says the executive is traveling or in a meeting, so the reader can't call to check.

The vendor with new bank details

The attacker writes as a supplier you already pay, often from a look-alike of the supplier's domain, and asks you to send the next payment to a new account.

The payroll change

The attacker writes to HR or payroll as an employee and asks to move their direct deposit to a new bank account before the next pay date. The message usually comes from a free mail account with the employee's name on it, and it reads like any other routine request.

It works because HR handles bank changes all the time, and the attacker only needs a name, which is often on the company website or a social profile. The real employee finds out when their paycheck doesn't arrive, and by then the money is often gone.

How protected identities stop it

With SpamFoo's Anti-Phishing, each domain keeps a list of protected identities: the names attackers are likely to copy, and the addresses or domains each person really sends from. When a message uses one of those names from an address that isn't on the list, SpamFoo marks it as phishing.

Look-alike domain checks cover the vendor form. A sender domain that looks like one of your approved senders, or like a well-known domain, is marked as phishing too.

The payroll form is caught the same way when the employee's name is on the list. Since attackers can copy any employee, import your staff from a vCard file so everyone is covered.

Set up protected identities

1. Open the SpamFoo dashboard and go to Phishing, then Protected identities.
2. Add the names attackers are likely to copy: your owner or CEO, finance and payroll contacts, and role names such as "IT Help Desk".
3. For each name, add the addresses or domains that person really sends from.

You can import many people at once from a vCard file. Step-by-step instructions are in the help center.