Business Email Compromise: The Quiet Heist
Business email compromise is a financial fraud in which criminals gain control of, or convincingly imitate, a trusted email account and use it to redirect a legitimate payment into an account they control. The detail worth reconstructing is what the attacker never does. No malware is dropped, no vulnerability is exploited, and no firewall is breached. The fraud moves through authenticated sessions and approved business processes, which is why so much defensive attention aimed at perimeters and endpoints ends up looking in the wrong place. What follows is a reconstruction of how a single wire leaves a company, and where the evidence was sitting the whole time.
A payment that cleared every check
In business email compromise, the fraudulent instruction usually arrives from a real account rather than a spoofed one, which means it passes every authentication check an email system performs. Picture a controller in accounts payable who receives updated banking details on an invoice they were already expecting, inside a supplier thread they recognize. The message clears SPF, DKIM, and DMARC, because it is genuinely sent from the supplier's mailbox. The wire is approved through the normal workflow. Days later the supplier asks where their payment is. No alert ever fired, because there was nothing for a malware sandbox or an intrusion sensor to catch. The control that failed was the process that treated a familiar email as proof of a legitimate request.
Reconstructing the first login
Most business email compromise begins with a stolen login rather than a planted program. The common route is credential phishing, increasingly through adversary-in-the-middle kits that capture the session token at sign-in and let the attacker inherit an already-authenticated session, stepping past multi-factor authentication rather than defeating it directly. In its Global Incident Response Report 2026, Palo Alto Networks Unit 42 found that stolen session tokens and illicit OAuth grants allow attackers to bypass interactive authentication, including MFA, and that roughly 65 percent of initial access it investigated was identity-driven. In MITRE ATT&CK terms this is Valid Accounts. Once the token is replayed, the intruder is indistinguishable from the employee at the identity layer, which is the whole problem: the attacker holds the login, not merely a lookalike of the logo.
The weeks spent reading your mail
After gaining access, a business email compromise actor typically waits and reads before acting. This is the quiet residence that gives the fraud its name. The attacker often creates inbox rules that automatically file or delete replies, bounce-backs, and security notices, a defense-evasion technique cataloged by MITRE ATT&CK as Email Hiding Rules (T1564.008) and commonly created through the New-InboxRule cmdlet in Microsoft environments. Forwarding rules quietly copy finance conversations elsewhere (Email Forwarding Rule, T1114.003). During this window the attacker learns the invoice cadence, the tone of the parties, and who signs off on payments. The patience is rational: the IBM Cost of a Data Breach Report 2025 put the average time to identify and contain a breach at 241 days, and quiet access is what buys that time.
The IBM Cost of a Data Breach Report 2025 put the average time to identify and contain a breach at 241 days.
Why the fraudulent email looks real
The difference between phishing and business email compromise is ownership: phishing imitates a trusted sender, while business email compromise sends from the trusted account itself. That distinction changes what defenders can rely on. When the attacker replies inside an existing thread the recipient started, the request to change payment details lands with full context and history behind it. Where the fraud pivots to other staff, MITRE ATT&CK describes it as Internal Spearphishing (T1534), abusing the credibility of a genuine internal account. Content authentication cannot flag a message that is authentically from the real mailbox, so detection has to move to behavior: unusual rule creation, a banking-detail change, a first-time payee, a request that breaks the established rhythm.
Following the money after it moves
Once a fraudulent wire is sent, recovery depends almost entirely on speed, because the funds are layered across mule accounts and jurisdictions within hours. The scale is documented. In its September 2024 public service announcement, the FBI's Internet Crime Complaint Center reported roughly 55 billion dollars in global exposed losses to business email compromise between October 2013 and December 2023, with the scam reported in all 50 states and 186 countries, and banks in the United Kingdom and Hong Kong frequently acting as intermediary stops. The same agency's Recovery Asset Team, which works the Financial Fraud Kill Chain, froze about 561.6 million dollars in 2024 at a 66 percent success rate, but only where victims reported fast. The recovery clock, roughly the first 24 to 72 hours, is a business decision before it is a technical one.
The FBI's Internet Crime Complaint Center reported roughly 55 billion dollars in global exposed losses to business email compromise between October 2013 and December 2023.
The evidence a mailbox actually keeps
The forensic record of a business email compromise lives in identity and mailbox logs, not in malware samples or network captures. A reconstruction reads the sign-in logs for impossible-travel patterns and unfamiliar networks, the mailbox audit log for who read which finance thread, the inbox-rule creation events for the filters that hid the replies, and the OAuth consent grants for any application the attacker authorized to keep access after a password reset. Working these cases from an MSSP and advisory seat, the first artifacts pulled are the rule set and the consent grants, because they show both intent and dwell time. Read in sequence, those logs also reveal the gap between the first anomalous login and the fraudulent instruction, which is the exact window in which the compromise could have been caught. This is where the vantage point matters. An email vendor sells the filter that the legitimate mail sailed past, and a law firm tallies the loss after the fact, while the identity and mailbox telemetry is what actually reconstructs the heist.
Controls that assume the account is already trusted
Effective business email compromise defense assumes the attacker may already hold a valid login, and places controls on both the identity and the payment process. On identity, CISA recommends phishing-resistant multi-factor authentication such as FIDO2 and WebAuthn, which resists the adversary-in-the-middle kits that steal session tokens from weaker methods. On process, CISA's guidance on the scam is to verify every payment-detail change out of band, using a phone number already on file rather than one supplied in the email, and to limit and dual-approve who can move funds above a threshold. Two further controls close the gap the reconstruction exposed: continuous monitoring for new inbox and forwarding rules and new OAuth grants, and the ability to revoke active sessions and tokens rather than only resetting a password. Controls that work treat a trusted login as a hypothesis to be checked, not a conclusion to be acted on.
Sources
Federal Bureau of Investigation, Internet Crime Complaint Center. 2024 Internet Crime Report.https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf
Federal Bureau of Investigation, Internet Crime Complaint Center. Business Email Compromise: The $55 Billion Scam (Public Service Announcement, 11 September 2024). https://www.ic3.gov/PSA/2024/PSA240911
MITRE ATT&CK. Hide Artifacts: Email Hiding Rules (T1564.008) and Internal Spearphishing (T1534).https://attack.mitre.org/techniques/T1564/008/ and https://attack.mitre.org/techniques/T1534/
Palo Alto Networks, Unit 42. Global Incident Response Report 2026.https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report
IBM. Cost of a Data Breach Report 2025.https://www.ibm.com/think/x-force/2025-cost-of-a-data-breach-navigating-ai
Cybersecurity and Infrastructure Security Agency (CISA). Business Email Compromise alert and Implementing Phishing-Resistant MFA fact sheet. https://www.cisa.gov/news-events/alerts/2015/06/24/business-email-compromise-continues-swindle-and-defraud-us-businesses and https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf
Disclaimer
This article is provided for general informational and educational purposes and does not constitute legal, financial, or professional security advice. The incident described is an illustrative reconstruction built from documented attack techniques and does not depict any specific organization, client, or case. Statistics are attributed to their named primary sources and were accurate as of publication; figures reported to agencies such as the FBI reflect only what victims chose to report and understate true totals. Organizations should assess their own risk and consult qualified professionals before acting on any control discussed here.
Business email compromise
Frequently asked questions
Business email compromise is a financial fraud in which criminals gain access to, or convincingly imitate, a trusted business email account and use it to redirect a legitimate payment to an account they control. It rarely involves malware. The fraud succeeds by moving through authenticated email sessions and normal payment approvals, so the controls that matter most sit on identity and on the payment process rather than on the network perimeter.
The difference is ownership: phishing imitates a trusted sender, while business email compromise sends from the trusted account itself after taking it over. That distinction is practical, because a message from the genuine mailbox passes SPF, DKIM, and DMARC and carries real thread history. Detection therefore has to focus on behavior, such as new inbox rules, banking-detail changes, and first-time payees, rather than on sender authenticity alone.
Business email compromise is among the costliest cybercrimes tracked in the United States. The FBI's Internet Crime Complaint Center recorded about 2.77 billion dollars in reported BEC losses across 21,442 complaints in 2024, ranking it second by dollar loss. Over the longer horizon, the same agency reported roughly 55 billion dollars in global exposed losses between October 2013 and December 2023, spanning all 50 states and 186 countries.
Effective prevention assumes the attacker may already hold a valid login and controls both identity and payment. CISA recommends phishing-resistant multi-factor authentication such as FIDO2 or WebAuthn, which resists the adversary-in-the-middle kits that steal session tokens. On the process side, verify every payment-detail change out of band using a number already on file, require dual approval above a threshold, and monitor mailboxes for new forwarding rules, inbox rules, and OAuth application grants.
Speed determines recovery, because fraudulent funds are moved through mule accounts within hours. Contact the sending bank immediately to request a recall, then file with the FBI's Internet Crime Complaint Center at ic3.gov so its Recovery Asset Team can attempt to freeze the transfer through the Financial Fraud Kill Chain, which reported a 66 percent success rate in 2024. Preserve sign-in logs, mailbox rules, and OAuth grants for forensic review, and revoke active sessions rather than only resetting passwords.
