They work because the attacker exploits routine, urgency, and pre-existing trust in vendor communication. When the message fits the recipient’s normal workflow, people are more likely to reply or forward it before they verify the request. That is why controls need to interrupt action, not only improve awareness.
Why familiar-looking BEC and VEC emails still convert
The message does not have to look novel to work. These campaigns exploit routine, urgency, and the recipient’s expectation that a vendor or colleague will sometimes send a fast payment, document, or login request. If the email fits the normal workflow, it can trigger action before anyone pauses to verify the request.
What the attacker is actually borrowing from the business process
BEC and VEC succeed by riding on legitimate communication patterns, not by defeating the recipient with sophistication alone. The sender name, subject line, tone, and request format are often close enough to expected business mail that the victim treats the message as a routine exception rather than a threat. That is why these emails often ask for forwarding, approval, payment, or a quick response: those are the actions most likely to be taken reflexively.
Vendor-themed lures are especially effective when they mimic an existing relationship or process step. A finance team, procurement owner, or executive assistant already expects invoice follow-up, document sharing, or account change notices, so the attacker only needs to create just enough plausibility to avoid immediate scrutiny.
The useful Email Identity and BEC Guide is relevant here because the control problem is not just spotting spoofing, it is preventing routine business mail from becoming an execution path for fraud.
Why awareness alone does not stop the click or the reply
Awareness helps people notice warning signs, but it does not reliably interrupt a task that already feels normal, time-sensitive, and socially expected. Recipients often make a quick judgment based on context, not deep verification, especially when the request appears to come from a familiar vendor, manager, or internal partner. In practice, the attacker wins when the message is believable enough to fit the recipient’s mental model of work.
That is also why these emails frequently target moments when people are busy, distracted, or under deadline pressure. The shorter the decision window, the more likely the recipient is to choose speed over verification. Familiarity reduces friction, and reduced friction increases the chance of action.
For operators who want the attack path rather than just the symptom, the TruffleNet stolen AWS keys campaign 2025 shows how stolen access can be paired with convincing invoice fraud, making the request look like a legitimate business interaction.
What changes the outcome in real organisations
The control objective is to interrupt the action path at the point of decision. That means building verification into the workflow itself, not relying on employees to remember a policy after they have already opened the message. If a message can trigger payment, mailbox changes, document release, or sensitive approval, then the process should force a second check before the action is completed.
Practically, the strongest programmes combine mailbox filtering, domain authentication, payment-change verification, and clear out-of-band confirmation rules for sensitive requests. The point is to make it harder for a plausible message to produce immediate business action. A good control set assumes that some malicious messages will look normal, so it focuses on slowing down the step that creates loss.
One reason this matters is that action often happens before technical indicators are obvious. By the time a user realises the request was fraudulent, the email may already have been forwarded, funds may already be in motion, or account changes may already be underway.
Risk and Threat Considerations
BEC and VEC are risky because they exploit the exact behaviours organisations depend on for speed: trust, delegation, and rapid handoff. The attacker does not need to break email in a technical sense if the recipient is willing to act on a message that fits normal business traffic.
Failure mechanism: The message lands inside an expected process, then the recipient approves, forwards, pays, or shares information before verification interrupts the workflow.
Impact: The result can be payment diversion, mailbox compromise, data exposure, or downstream fraud that looks like an ordinary business transaction until it is too late.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | BEC and VEC exploit weak workflow and account-change controls around business requests. |
| Recommendation — Enforce approval and verification steps for high-impact account and payment changes. | ||
| OWASP API Security Top 10 | API6 — Unrestricted Access to Sensitive Business Flows | The core problem is unauthorised completion of sensitive business actions through a trusted-looking request. |
| Recommendation — Restrict sensitive business flows with step-up checks and explicit approval gates. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | These attacks rely on impersonation and misattribution of trusted senders. |
| Recommendation — Require strong authentication for users who can approve or release high-impact actions. | ||
Practitioner Guidance
What to prioritise: Put the strongest verification step at the point where money, credentials, or sensitive data would leave the organisation. If the request can cause loss in one click, the process is too permissive.
What to verify: Check whether the control actually forces a pause, an alternate channel, or a second approver for high-impact vendor and invoice changes. A policy that only trains users but leaves the workflow unchanged is weak against familiar-looking mail.
Decision rule: If the message asks for urgency, secrecy, payment redirection, mailbox changes, or a document release that matters financially, treat the request as a verification event, not a reply event.
Practitioner takeaway: The measure of success is not whether people can recognise a suspicious email, it is whether the organisation has made suspicious-looking routine mail unable to cause immediate action.