Business email compromise is exploiting trust and process gaps

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Proofpoint's blog post: Business email compromise succeeds by exploiting trust relationships and business processes, not by delivering obviously malicious email content.

Why it matters: IAM, PAM, and email security teams need to treat BEC as an identity and workflow abuse problem, because authentication alone does not stop compromised accounts, thread hijacking, or fraudulent approvals.

By the numbers:

• Business email compromise has led to more than US$55 billion in attempted or actual losses worldwide since 2013.

Context

Business email compromise is a trust abuse problem that works because requests look legitimate to the recipient and often arrive through normal communication channels. Traditional email controls focus on malicious links, attachments, and spoofing, but BEC commonly uses compromised accounts, reply-chain hijacking, and process manipulation instead of obvious malware.

The identity angle matters because the attacker is not just sending email. They are borrowing authority from a person, mailbox, or business relationship, then using that trust to push actions that bypass normal verification. In modern cloud email and agentic workflow environments, the gap is less about content inspection and more about whether the request fits the expected identity, relationship, and process context.

Key questions

Q: What breaks when BEC controls rely only on email filtering and DMARC?

A: Filtering and DMARC reduce spoofing, but they do not stop attacks that use compromised accounts, thread hijacking, or messages that fit the normal conversation context. In practice, BEC breaks the assumption that malicious email always looks malicious. Defences must therefore validate identity, relationship history, and workflow legitimacy, not just message content.

Q: Why do compromised mailboxes make BEC harder to detect?

A: A compromised mailbox carries the trust of a real person, vendor, or executive, so the attacker can send requests from a context recipients already accept. That bypasses many content-based detections and makes fraudulent asks look routine. The risk is not only mailbox access, but the authority and familiarity attached to that account.

Q: What are the warning signs that BEC controls are too weak?

A: Warning signs include approvals happening only through email, inconsistent verification for payment or access changes, and a lack of separation between routine communication and sensitive business actions. If staff can complete high-risk requests without a second check, the organisation is relying on trust rather than control.

Q: How should financial institutions verify high-risk requests without slowing operations too much?

A: Use tiered verification for requests that can move money, reset credentials or expose sensitive data. Low-risk activity can follow normal workflow, but high-risk actions should require a separate callback, a second approver or a known trusted channel. The goal is to make urgency irrelevant when identity and authority are being asserted.

Technical breakdown

Why BEC bypasses content-based email controls

BEC avoids the detections that work well against commodity phishing. There is often no malicious link, attachment, or payload to scan, and the message may come from a real or compromised mailbox inside an existing conversation thread. That means sender reputation and domain authentication help against spoofing, but they do not prove that the request is legitimate. The real security boundary is no longer the email gateway alone. It is the combination of identity trust, conversation context, and workflow validation. When attackers can speak with the right tone and timing, the message looks operationally normal even when it is fraudulent.

Practical implication: Use email controls to catch spoofing, but move trust decisions to mailbox identity, conversation history, and business-process checks.

How compromised mailboxes change the threat model

When an attacker gains access to a legitimate mailbox, they inherit the relationship graph of that account. They can observe how invoices are approved, who responds to whom, and which language is normal for finance, HR, or executive communications. That turns a mailbox into a trusted distribution point for fraud rather than just a messaging account. In identity terms, the compromise is not only access to the inbox. It is access to the authority and familiarity attached to that inbox. This is why BEC and email account compromise are so tightly linked in real incidents.

Practical implication: Treat mailbox compromise as delegated authority abuse, not just unauthorized access to email.

Why agentic workflows expand BEC exposure

As organisations automate approvals and move more work into cloud collaboration and agentic AI workflows, there are more machine-assisted paths for social engineering to exploit. A workflow that expects routine approvals can be manipulated if it trusts a request too quickly, especially when an attacker can imitate a vendor, executive, or service desk pattern. The governance issue is that speed becomes a control weakness when verification is informal. If the process rewards urgency and familiarity more than confirmation, the attacker needs very little technical sophistication to succeed. This is a process-control problem as much as an email problem.

Practical implication: Insert verification and segregation of duties into high-risk digital workflows before automation compresses review time.

Threat narrative

Attacker objective: The attacker’s objective is to extract money, data, or payment redirection by abusing trusted business communication.

1. Entry occurs through social engineering, compromised accounts, or thread insertion rather than a malicious attachment or link.
2. Credential or mailbox access gives the attacker a trusted communication channel that can bypass recipient suspicion and some email controls.
3. The attacker escalates trust by impersonating executives, vendors, or colleagues and uses that authority to request payment, data, or account changes.
4. Impact is financial loss, sensitive-data exposure, or unauthorized workflow execution that appears legitimate until after the damage is done.

Breaches seen in the wild

• TruffleNet stolen AWS keys campaign 2025: TruffleNet used 800+ attacker hosts to test stolen AWS keys and check SES capacity; one compromised account sent a fake $50,000 invoice.
• Microsoft verified publisher OAuth phishing 2022: Malicious OAuth apps with a fraudulently obtained Microsoft verified publisher badge tricked UK users into granting mailbox access in 2022.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

BEC is now a governance problem, not an email-filtering problem. The article shows that attackers win by abusing trusted relationships, timing, and normal business process, which means the control failure sits above the message layer. Authentication and filtering still matter, but they do not validate whether a request is contextually legitimate. For identity teams, this is a reminder that trust decisions belong in process controls, not only in transport or content controls.

Mailbox compromise creates a delegated-authority problem that traditional phishing training does not address. Once an attacker owns a legitimate mailbox, they inherit the communication patterns, internal credibility, and approval pathways of that account. That is why BEC cannot be handled as a simple awareness issue. The governance gap is the assumption that legitimate identity equals legitimate intent. Practitioners need to treat mailbox trust as a controlled privilege, not an ambient assumption.

Process speed is becoming an attack surface. As finance, vendor management, and executive approvals move faster in cloud collaboration environments, the organisation gives attackers less time to be challenged and more room to exploit urgency. This is particularly relevant where agentic AI workflows or automated approval chains are expected to move work without human scrutiny. The control boundary has to shift to request validation, exception handling, and trusted-channel verification.

Identity verification must extend into communications and workflow policy. BEC is one of the clearest examples of why identity security cannot stop at login. The article implicitly validates a broader model in which who sent the request, how the request fits prior behaviour, and whether the business action is consistent with policy all matter. In practice, security teams should align email defence, IAM, and finance controls so that identity misuse is visible before funds or data move.

Trusted-channel abuse is the named concept practitioners should watch. BEC succeeds because the attacker uses a channel the recipient already trusts, then hides inside legitimate process patterns. That pattern will only become more common as cloud email and AI-assisted messaging reduce friction in daily business operations. Practitioners should assume that the highest-risk requests are the ones that look operationally ordinary.

From our research library:

• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
• Businesses report a 200% surge in attempted deepfake-aided wire fraud in Q1 2025 alone.
• Read next: Account Recovery and Help Desk Security Guide

What this signals

Trusted-channel abuse will remain the core BEC pattern. As cloud email and agentic workflows become more embedded in everyday business, attackers will continue to exploit requests that look operationally normal. Security teams should assume that the highest-risk message is often the one that most closely matches routine work, not the one with obvious phishing tells.

Identity controls have to move closer to the business process. Mailbox protection alone does not stop a fraudulent request once the requester, thread, or vendor relationship looks familiar. Teams that want durable reduction in BEC risk need to connect IAM, finance controls, and user verification around the actions that actually move value.

43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec. That concern is relevant here because AI-assisted communication can make social engineering more scalable while still appearing contextually correct.

For practitioners

• Map high-risk communication paths Identify which roles, vendors, and request types routinely trigger money movement, account changes, or sensitive-data sharing, then apply extra verification to those paths.
• Add identity checks to approval workflows Require independent confirmation for payment changes, bank-detail updates, executive requests, and other high-impact actions before they are executed.
• Monitor for mailbox compromise signals Watch for abnormal login patterns, new inbox rules, conversation insertion, and unexpected changes in sending behaviour across Microsoft 365 and similar environments.
• Train users on BEC-specific scenarios Focus awareness training on executive impersonation, vendor invoice fraud, and thread hijacking rather than generic phishing examples that rely on links or attachments.

Key takeaways

• BEC succeeds because attackers abuse trust, not just inboxes, which makes identity and workflow control more important than message filtering alone.
• Proofpoint cites more than US$55 billion in attempted or actual losses across more than 300,000 attacks since 2013, underscoring the scale of the problem.
• The most effective defences combine behaviour monitoring, role-based verification, and tighter controls around payment and approval workflows.

Key terms

• Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.
• Thread hijacking: An attack where a malicious actor inserts or reuses messages inside an existing email conversation to appear legitimate. It works because recipients trust the thread history, making the message more likely to bypass suspicion and trigger a business action or credential disclosure.
• Mailbox compromise: Mailbox compromise occurs when an attacker gains control of an email account or can act within it as if they were the legitimate user. In identity terms, it turns email into an abuse channel for fraud, lateral trust exploitation, and policy bypass unless the organisation can detect and contain the takeover quickly.
• Trusted channel abuse: Trusted channel abuse happens when attackers use familiar communication paths such as email, messaging apps, or mobile workflows to obtain credentials or approvals. The channel appears legitimate to the user, but it bypasses visibility and control layers that only monitor managed systems.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management. It helps security and identity practitioners connect identity controls to the business processes attackers try to abuse.