BEC scams exploit trust, not malware, to redirect payments

At a glance

What this is: NHI Mgmt Group's analysis, drawing on DNSFilter's blog post: Business Email Compromise succeeds by manipulating trust, timing, and payment workflows rather than by using malware or technical exploits.

Why it matters: It matters because finance, IAM, and security teams need controls that verify requests, protect mail identity, and interrupt fraudulent payment changes before money leaves the business.

By the numbers:

• Business Email Compromise losses exceeded $2.7 billion in 2024, according to a CertifID summary of the FBI IC3 report cited by DNSFilter.
• Global BEC losses surpassed $55 billion between 2013 and 2023, according to the FBI IC3 public service announcement cited by DNSFilter.
• Overall U.S. cybercrime losses rose 33% year-over-year to $16.6 billion in 2024, according to an FBI El Paso Field Office release cited by DNSFilter.

Context

Business Email Compromise is a social engineering fraud pattern that redirects legitimate business actions, usually payments or sensitive data requests, into attacker-controlled channels. It works because the message appears routine, urgent, and credible enough to bypass normal judgment and process.

The core governance gap is that many organisations still treat email as a communication problem rather than a transaction risk problem. BEC succeeds when trust, process speed, and weak verification are allowed to converge, and that makes it as much an identity and workflow issue as a mail security issue.

Key questions

Q: How should organisations reduce business email compromise risk without relying only on awareness training?

A: Use layered controls that verify requests outside the inbox, especially for payments, bank changes, and access-related actions. Combine behaviour-based detection, vendor verification, and approval workflows that require independent confirmation before a request becomes an authorised business step. Awareness helps, but process control is what limits damage.

Q: Why do phishing and business email compromise continue to succeed even when organisations invest in awareness training?

A: Phishing succeeds because attackers exploit timing, trust, and human judgment, not just technical gaps. The report shows many organisations still experience successful attacks, even while training exists, which suggests awareness alone is insufficient. Security teams need layered controls such as email filtering, user reporting, rapid response, and consequence models that make risky behavior visible and correctable.

Q: What are the warning signs that a payment request may be a BEC scam?

A: Watch for altered bank details, unusual urgency, secrecy, late-stage changes in an ongoing thread, or requests that bypass normal approval steps. A request becomes high risk when it combines financial action with pressure to avoid verification. The safest response is to pause and validate through a separate channel before any transfer occurs.

Q: What should teams do after a BEC attempt is discovered?

A: They should contain the payment path immediately, notify banking partners, preserve message and header evidence, and review whether the attacker accessed a trusted mailbox or supplier account. The goal is to stop additional transfers, recover funds where possible, and close the communication path that allowed the deception to spread.

Technical breakdown

How BEC abuse works without malware

BEC usually avoids links, attachments, and obvious payloads. The attacker instead engineers a believable message that fits an existing business process, then uses social pressure to get a legitimate person to perform a legitimate action in the wrong direction. That can be a wire transfer, invoice update, payroll diversion, or vendor bank detail change. Because the fraud lives in the content and the context, traditional spam and malware controls often have little to inspect. The real attack surface is the decision path inside the business process, not the mailbox itself. See the Email Identity and BEC Guide.

Practical implication: Treat payment approval and vendor change requests as controlled workflows, not as ordinary email replies.

Why trusted accounts and vendor threads bypass detection

Attackers increasingly use compromised supplier accounts, lookalike domains, and thread hijacking to make messages appear authentic. Once an existing conversation is hijacked, the attacker inherits context, language patterns, and timing cues that reduce suspicion. This is why BEC often survives standard awareness training: the user is not reacting to a suspicious stranger but to a seemingly normal transaction in progress. The identity problem is that the mailbox or vendor account itself becomes the trusted delivery mechanism, even when the human reader is cautious.

Practical implication: Require out-of-band verification for any mid-thread change to payment instructions or sensitive account details.

Why DNS-layer controls matter in BEC campaigns

DNS filtering sits earlier in the attack path than the inbox decision. Even when the scam begins in email, successful BEC operations often depend on malicious infrastructure such as redirect domains, credential-harvest pages, or external command links used to support follow-on fraud. DNS-layer controls can block resolution to known malicious destinations and reduce exposure to the infrastructure that supports the campaign. That does not replace mailbox security or verification procedures, but it does remove one of the paths attackers rely on to sustain the operation. See the Email Security Buyer's Guide.

Practical implication: Use DNS controls to reduce exposure to the external infrastructure that supports fraud campaigns.

Threat narrative

Attacker objective: The attacker’s objective is to divert legitimate business payments into accounts they control and launder the proceeds before reversal is possible.

1. Entry begins with a personalised email that impersonates a vendor, executive, or trusted partner and matches an active business thread.
2. Credentialed trust is abused when the victim follows the request and updates payment instructions, reroutes payroll, or approves a transfer without secondary verification.
3. Impact occurs when funds are moved into attacker-controlled accounts and then dispersed through money mule networks or cryptocurrency exchanges.

Breaches seen in the wild

• Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.
• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

BEC is a workflow compromise, not just an email compromise. The central failure is not that users receive a message, but that business processes allow a single message to trigger a high-value action without robust challenge. That means the real control boundary sits around payment and data-change workflows, not around inbox awareness alone. Practitioners should treat BEC as a governance problem that crosses finance, identity, and security operations.

Email trust hijacking is the right concept for this category. The attacker does not need to defeat malware controls if they can inherit trust through a real account, a real thread, or a highly plausible impersonation. That is why mail authentication, vendor verification, and payment controls must be designed together rather than as separate silos. Practitioners should map every trusted communication path that can authorise money movement or data change.

Human judgment remains the weakest and most valuable control point. BEC works because urgency and authority can suppress normal verification behaviour faster than technical controls can intervene. The answer is not to blame users, but to design processes that make verification the default action when money or sensitive data is at stake. Practitioners should assume that any process dependent on a rushed reply is already exploitable.

The fraud economy around BEC is now industrialised. The article’s losses show that these scams are not isolated incidents but a repeatable business model supported by mule accounts, payment rails, and fast laundering. That shifts the defensive question from whether a message looks real to whether the organisation can stop value transfer after a deceptive request succeeds. Practitioners should focus on containment before the funds exit the control boundary.

What this signals

Email trust hijacking: this is the more precise lens for modern BEC. The attack is successful when trusted communication channels are used to authorise value transfer, which means the control problem spans messaging, identity assurance, and finance process design. Practitioners should stop treating BEC as a user-awareness issue alone and build controls around trust inheritance.

The defensive threshold is shifting from detection to interruption. If an organisation cannot block malicious domains, validate sender identity, and independently confirm high-risk requests, then a believable message can still become an irreversible financial event. That makes BEC a governance issue as much as a security issue.

For practitioners

• Strengthen payment verification workflows Require out-of-band confirmation for any new or changed payment instruction, bank detail, payroll destination, or invoice exception before release.
• Harden email identity controls Enforce SPF, DKIM, and DMARC, and review mailbox permissions that allow external senders or delegated access to imitate trusted communication flows.
• Train against thread hijacking and vendor impersonation Use simulations that include compromised supplier accounts, mid-thread payment changes, and executive urgency rather than generic phishing examples.
• Block known fraud infrastructure at the DNS layer Filter malicious domains used for redirects, fake login pages, and supporting fraud infrastructure before users can reach them.
• Add transaction controls for high-risk business processes Separate request creation, approval, and release across different people or systems for wire transfers, payroll changes, and vendor onboarding.

Key takeaways

• BEC is a trust abuse problem that turns legitimate business workflows into payment fraud opportunities.
• The article cites losses of more than $2.7 billion in 2024 and over $55 billion globally between 2013 and 2023.
• The most effective controls are out-of-band verification, mail authentication, workflow separation, and infrastructure blocking.

Related NHI Mgmt Group resources: Email Identity and BEC Guide · Top 10 Online Fraud Attacks · Top 10 Phishing Techniques · Email Security Buyer's Guide

Key terms

• Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.
• Vendor Email Compromise: Vendor email compromise is a form of impersonation that targets supplier, contractor, or partner relationships. Attackers exploit routine vendor communication patterns to request payment changes, invoice redirection, or other sensitive actions, so identity and process verification must extend beyond internal users.
• Out-Of-Band Verification: A confirmation step that uses a different channel or method than the original request. It reduces the chance that a single spoofed email, voice call, or video session can authorize privileged activity or financial transfer.
• Thread hijacking: An attack where a malicious actor inserts or reuses messages inside an existing email conversation to appear legitimate. It works because recipients trust the thread history, making the message more likely to bypass suspicion and trigger a business action or credential disclosure.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. It is suitable for practitioners who need to connect identity controls to broader security and fraud resilience programmes.