What are the signs that business email compromise tactics are becoming stealthier?

A key sign is a shift from obvious VIP impersonation toward general employee impersonation, which lowers suspicion and blends into routine work. Another indicator is selective targeting of executives through messages that appear to come from other executives. When impersonation becomes less conspicuous but more role-specific, organisations should assume attackers are refining social engineering to improve success rates.

How Stealthier BEC Changes the Attack Pattern

Stealthier business email compromise usually looks less like a crude spoof and more like a believable internal message. Attackers reduce the obvious signals that users have learned to distrust, then rely on context, timing and organisational familiarity to make the message feel routine rather than suspicious. That shift matters because it changes what defenders can no longer assume from the message alone.

As impersonation gets quieter, the attacker’s goal is not just to fool one recipient, but to fit into normal workflow. Messages that imitate ordinary employee communication are easier to ignore in a busy inbox, and that is exactly why the tactic becomes harder to spot.

One practical way to think about the trend is that the adversary is optimising for plausibility, not volume. A campaign can become more effective while looking less dramatic, because the attacker is testing which identities, roles and interaction patterns attract the least scrutiny.

Why Role-Specific Impersonation Is the Key Signal

When BEC shifts from VIP impersonation to employee-to-employee impersonation, the attacker is exploiting trust inside the organisation rather than only trust in leadership. General employee impersonation lowers suspicion because the message no longer looks exceptional, while selective executive targeting can still be hidden inside apparently normal internal conversations.

The important clue is not just that executives are still being targeted, but that the messages appear to originate from other executives or adjacent roles. That indicates a more tailored social engineering approach, where the attacker is studying reporting lines, approval habits and routine exchanges to make the request feel expected.

This is also why BEC can become stealthier without becoming more technically complex. The message does not need to contain malware or obvious credential harvesting if it can trigger a payment, document release or account change through ordinary business trust. The less conspicuous the impersonation, the more the attack depends on judgement under time pressure.

What Defenders Should Watch For in the Inbox and Workflow

Stealthier BEC often leaves weaker message-level clues but stronger behavioural clues. Watch for requests that are narrowly tailored to the recipient’s role, especially when they reference internal relationships, approval chains, urgent timing or unusual confidentiality. A message that feels “specific enough to be real” is often more dangerous than one that obviously looks fake.

The other warning sign is a gradual reduction in obvious mismatch indicators. If attackers are becoming more convincing, they will avoid awkward phrasing, public-facing executive names and generic payment language, and instead mirror the recipient’s usual working patterns. That means organisations need to look at sequence and context, not just email headers or display names.

Requests that fit the recipient’s normal authority level but bypass the usual review path.
Messages that reference internal roles or approval habits with unusual precision.
Executive-targeted requests that are framed as ordinary cross-functional communication.
Invoices, transfers or document changes that are presented as routine follow-up rather than urgent escalation.

Risk and Threat Considerations

Stealthier BEC is riskier because it reduces the chance that users will notice a clear impersonation cue before acting. As the tactic blends into ordinary internal communication, the organisation’s main exposure shifts from obvious phishing indicators to trust abuse inside routine business processes.

Failure mechanism: The attacker studies internal role relationships and message style, then sends a request that is believable enough to pass informal scrutiny and trigger action before verification.

Impact: Organisations face a higher likelihood of fraudulent payment, sensitive data release, or account manipulation, especially where approval is handled informally or under time pressure.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1656 — Impersonation	BEC stealth depends on impersonating trusted internal roles and executives.
	T1566 — Phishing	BEC is a phishing-led social engineering technique that uses believable lures.
Recommendation — Map suspicious role-based impersonation to T1656 and validate requests out of band. Hunt for phishing-style delivery and user-targeted deception patterns in mail workflows.
NIST SP 800-53 Rev 5	AT-2 — Awareness Training	Users need training to recognise subtle BEC and verify high-risk requests.
	AC-3 — Access Enforcement	BEC often aims to trigger unauthorised access or payment actions through business workflows.
	AU-6 — Audit Record Review, Analysis, and Reporting	Reviewing mailbox and workflow logs helps identify deceptive request patterns.
Recommendation — Train staff to verify unusual payment or access requests through independent channels. Enforce approval gates so sensitive actions require the right authorisation path. Review logs for unusual request sequences and approval-path deviations.

Practitioner Guidance

What to verify: Treat requests that are plausible but role-specific as higher risk when they ask for money, data or access changes. Verify the requester through an out-of-band path that matches the business process, not the email thread that may have been compromised or spoofed.

What good looks like: Teams can explain which request types require secondary confirmation, who can approve them, and what evidence is retained when a request is validated. The best control is not perfect detection, but a process that still works when the message looks normal.

Common mistake: Assuming that a message is safe because it no longer looks like an obvious executive impersonation. Stealthier BEC often succeeds precisely because it resembles routine work.

Practitioner takeaway: When impersonation becomes more ordinary and more role-aware, the defence has to move from spotting “fake-looking” email to verifying high-trust requests before business context can be exploited.