What breaks when organisations rely only on email authenticity checks to stop business email compromise?

Email authenticity checks help, but they do not stop account theft, internal spoofing, or a compromised mailbox sending legitimate looking messages. Once an attacker is inside a real account, the message can bypass simple trust checks and reach staff who assume the request is valid. Organisations still need approval workflows and identity controls.

Why This Matters for Security Teams

Email authenticity checks are useful, but they only answer a narrow question: did the message appear to come from a legitimate sender? business email compromise fails in practice when teams assume that answer is enough. A real account can still be taken over, a vendor mailbox can be abused, or a trusted internal user can be manipulated into approving a fraudulent request. The result is not just spoofed mail, but trusted mail carrying attacker intent.

This is why NHI Management Group treats mailbox access, token hygiene, and approval paths as part of the same control problem. The attack pattern is visible in 52 NHI Breaches Analysis and in the TruffleNet BEC Attack — Stolen AWS Credentials, where stolen access created a path that simple authenticity filtering could not stop. NIST’s NIST SP 800-53 Rev 5 Security and Privacy Controls reinforces that detection must be paired with access and approval controls, not treated as a standalone safeguard.

In practice, many security teams encounter BEC only after a legitimate mailbox has already been used to send a convincing request, rather than through intentional spoofing.

How It Works in Practice

Authentication checks such as SPF, DKIM, and DMARC can reduce basic spoofing, but they do not verify the intent behind a message or the state of the account that sent it. If an attacker has valid mailbox access, the email is often delivered as trusted traffic. That is why BEC defense has to extend beyond message authenticity into identity, transaction, and approval controls.

Practitioners usually need three layers working together:

• Harden mailbox identity with phishing-resistant MFA, conditional access, and rapid session revocation after suspicious sign-in activity.

• Require out-of-band approval for payment, banking, credential reset, and vendor change requests, especially when the request arrives by email.

• Monitor for impossible travel, inbox rule creation, forwarding changes, and delegated access, because these are common signs that a legitimate account has been abused.

This is also where NHI discipline matters. Shared service accounts, API-driven notification mailboxes, and automation accounts can be abused in the same way as human mailboxes if their secrets are long-lived or widely exposed. The broader pattern is documented in Ultimate Guide to NHIs — Why NHI Security Matters Now, and it echoes the speed of credential abuse seen in LLMjacking: How Attackers Hijack AI Using Compromised NHIs. Guidance from the Anthropic AI-orchestrated cyber espionage report also shows that attacker workflows increasingly combine trusted access with rapid lateral action once inside a valid account.

These controls tend to break down when payment or vendor workflows are still approved informally through email threads, because social trust overrides technical warning signals.

Common Variations and Edge Cases

Tighter approval controls often increase friction and may slow urgent business processes, so organisations have to balance speed against fraud resistance. That tradeoff is real, especially in finance, procurement, and executive support functions where email remains the default coordination channel.

There is no universal standard for this yet, but current guidance suggests treating different request types differently. A password reset request is not the same as an invoice change, and a supplier bank update is not the same as a routine status update. High-risk actions should move to verified channels, while low-risk messages can remain email-based with monitoring in place.

Edge cases matter as well. Internal spoofing can bypass user suspicion because the sender address is genuine. Compromised vendor mailboxes can make fraud look like normal business correspondence. Automated mailboxes can generate alerts or attachments that appear legitimate even though the account is indirectly controlled. The right response is usually not more trust in the message header, but more trust in the decision process around the request. That is the lesson running through both the breach analysis in The 52 NHI Breaches Report and the credential exposure patterns in DeepSeek breach.

Where organisations rely on email authenticity alone, the control fails most often when a real account, a real workflow, and a real sense of urgency all line up in the attacker’s favour.

Related resources from NHI Mgmt Group

• What breaks when organisations rely on user interaction to stop NTLM credential theft?
• What breaks when organisations rely on SIM binding without additional identity checks?
• What breaks when organisations rely only on post-ingest application security scanning to stop malicious packages and supply-chain compromise?
• What breaks when organisations rely on standard hiring and access checks to stop deceptive contractor or worker infiltration?