What are the signs that business email compromise tactics are becoming stealthier?

How Stealthier BEC Changes the Attack Pattern

Stealthier business email compromise usually looks less like a crude spoof and more like a believable internal message. Attackers reduce the obvious signals that users have learned to distrust, then rely on context, timing and organisational familiarity to make the message feel routine rather than suspicious. That shift matters because it changes what defenders can no longer assume from the message alone.

As impersonation gets quieter, the attacker’s goal is not just to fool one recipient, but to fit into normal workflow. Messages that imitate ordinary employee communication are easier to ignore in a busy inbox, and that is exactly why the tactic becomes harder to spot.

One practical way to think about the trend is that the adversary is optimising for plausibility, not volume. A campaign can become more effective while looking less dramatic, because the attacker is testing which identities, roles and interaction patterns attract the least scrutiny.

Why Role-Specific Impersonation Is the Key Signal

When BEC shifts from VIP impersonation to employee-to-employee impersonation, the attacker is exploiting trust inside the organisation rather than only trust in leadership. General employee impersonation lowers suspicion because the message no longer looks exceptional, while selective executive targeting can still be hidden inside apparently normal internal conversations.

The important clue is not just that executives are still being targeted, but that the messages appear to originate from other executives or adjacent roles. That indicates a more tailored social engineering approach, where the attacker is studying reporting lines, approval habits and routine exchanges to make the request feel expected.

This is also why BEC can become stealthier without becoming more technically complex. The message does not need to contain malware or obvious credential harvesting if it can trigger a payment, document release or account change through ordinary business trust. The less conspicuous the impersonation, the more the attack depends on judgement under time pressure.

What Defenders Should Watch For in the Inbox and Workflow

Stealthier BEC often leaves weaker message-level clues but stronger behavioural clues. Watch for requests that are narrowly tailored to the recipient’s role, especially when they reference internal relationships, approval chains, urgent timing or unusual confidentiality. A message that feels “specific enough to be real” is often more dangerous than one that obviously looks fake.

The other warning sign is a gradual reduction in obvious mismatch indicators. If attackers are becoming more convincing, they will avoid awkward phrasing, public-facing executive names and generic payment language, and instead mirror the recipient’s usual working patterns. That means organisations need to look at sequence and context, not just email headers or display names.

• Requests that fit the recipient’s normal authority level but bypass the usual review path.
• Messages that reference internal roles or approval habits with unusual precision.
• Executive-targeted requests that are framed as ordinary cross-functional communication.
• Invoices, transfers or document changes that are presented as routine follow-up rather than urgent escalation.

Risk and Threat Considerations

Stealthier BEC is riskier because it reduces the chance that users will notice a clear impersonation cue before acting. As the tactic blends into ordinary internal communication, the organisation’s main exposure shifts from obvious phishing indicators to trust abuse inside routine business processes.

Failure mechanism: The attacker studies internal role relationships and message style, then sends a request that is believable enough to pass informal scrutiny and trigger action before verification.

Impact: Organisations face a higher likelihood of fraudulent payment, sensitive data release, or account manipulation, especially where approval is handled informally or under time pressure.

Practitioner Guidance

What to verify: Treat requests that are plausible but role-specific as higher risk when they ask for money, data or access changes. Verify the requester through an out-of-band path that matches the business process, not the email thread that may have been compromised or spoofed.

What good looks like: Teams can explain which request types require secondary confirmation, who can approve them, and what evidence is retained when a request is validated. The best control is not perfect detection, but a process that still works when the message looks normal.

Common mistake: Assuming that a message is safe because it no longer looks like an obvious executive impersonation. Stealthier BEC often succeeds precisely because it resembles routine work.

Practitioner takeaway: When impersonation becomes more ordinary and more role-aware, the defence has to move from spotting “fake-looking” email to verifying high-trust requests before business context can be exploited.

Related resources from NHI Mgmt Group

• What are the signs that supplier account compromise is being used to drive business email compromise?
• What are the signs that a business email compromise attempt is likely to be fraudulent?
• What are the signs that security awareness training is not enough to stop business email compromise?
• What are the signs that a business email compromise incident is already underway?