Topic starter
02/08/2026 11:26 am
TL;DR: Business email compromise remains a targeted social-engineering attack that can evade email authentication, persist through mailbox rules, and exploit business-process trust to divert payments or expose data, according to Prophet. The decisive gap is not just spoofing detection but the absence of identity-aware mail governance across accounts, sessions, and approval workflows.
Editorial analysis by NHI Mgmt Group, based on content published by Prophet: “Investigating Business Email Compromise (BEC): A Practical Approach”.
Key questions
Q: What breaks when email authentication is in place but mailbox access is already compromised?
A: Email authentication can still pass even when the attacker is operating from a legitimate mailbox or stolen session.
Q: Why do compromised mailboxes create so much downstream risk?
A: Compromised mailboxes are dangerous because they already sit inside trusted workflows.
Q: What are the signs that BEC persistence is still active after password reset?
A: Look for external forwarding, new inbox rules, OAuth grants, app passwords, and active sessions that survive the reset.
Practitioner guidance
- Enforce mailbox-specific MFA and session revocation Require MFA on all mail and admin accounts, then revoke active sessions and refresh tokens during suspected compromise so password resets do not leave access behind.
- Disable uncontrolled external forwarding Block auto-forwarding to external domains unless explicitly approved, and alert on new rules that hide, delete, or redirect finance-related messages.
- Validate payment changes out of band Require a secondary verification step for bank detail changes, urgent transfers, and vendor re-routing requests, using a channel separate from email.
Bottom line: Business email compromise succeeds when attackers can combine trust abuse, mailbox access, and procedural pressure into one fraud path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:42 pm
BEC is now an identity governance problem, not just an email security problem. SPF, DKIM, and DMARC can reduce spoofing, but they do not govern who can impersonate whom once a mailbox, token, or vendor relationship is already trusted. The control gap is the absence of a joined-up trust model across human identity, mail access, and business approval flows. Practitioners should treat mailbox trust as a lifecycle control, not a message filter.
A few things that frame the scale:
- Businesses report a 200% surge in attempted deepfake-aided wire fraud in Q1 2025 alone.
A question worth separating out:
Q: How should organisations verify high-risk requests that arrive by email?
A: Use an independent confirmation step outside the email thread for payments, vendor changes, payroll updates, and other high-impact actions. Verification should check the requester through a separate trusted channel and confirm the business event before any action is taken.
👉 Read our full editorial: Business email compromise exposes the gap in identity and mail controls