Why do phishing campaigns that use business email compromise and fake support accounts create outsized risk for organisations?

Why these campaigns create outsized organisational risk

business email compromise and fake support accounts work because they attack the decision layer of the organisation, not just the inbox. They exploit trust in known names, familiar workflows, and urgent requests, so a single deceptive message can trigger credential theft, payment fraud, or a rushed exception that bypasses normal controls.

The risk scales because these attacks are designed to look operationally normal. Once an attacker enters a business process through email, the same message can reach finance, IT, legal, and leadership without needing malware, making the blast radius much larger than a simple spam event.

When those trust paths are abused, the issue becomes less about whether one message is convincing and more about whether the organisation has built its processes so email can safely act as an authority signal.

How fake support accounts and BEC messages bypass normal suspicion

Fake support accounts mimic help desk, vendor, or internal service communication, so the recipient is primed to cooperate rather than challenge the request. Business email compromise works the same way, but often with more precision: attackers may reference real colleagues, current projects, invoice timing, or a known supplier to make the request feel routine.

This is why the attack is effective even when the content is not technically sophisticated. The social engineering succeeds by matching the organisation's normal communication pattern closely enough that the recipient applies the wrong decision rule, trusting context instead of verifying authority.

The strongest campaigns also exploit role ambiguity. If a message appears to come from support, finance, or an executive, the recipient may assume someone else already validated it, which creates a gap between perceived legitimacy and actual legitimacy.

What makes the impact broader than a single stolen account

The immediate harm is often credential theft, account takeover, or fraudulent payment instruction, but the larger impact is process contamination. A compromised mailbox or convincing fake support channel can be used to reset passwords, intercept approvals, harvest further contacts, and create follow-on fraud opportunities across multiple teams.

That is why these campaigns often become operational incidents as well as security incidents. They can disrupt procurement, payment processing, ticket handling, customer support, and executive communications because those functions depend on email as a trusted coordination channel.

For organisations that rely on email for approvals, the practical risk is not just loss of confidentiality. It is also loss of decision integrity, because a forged request can cause a legitimate employee to take an action that the business will later treat as authorised.

Risk and Threat Considerations

These campaigns are especially dangerous where payment approval, password reset, or vendor-change workflows still trust email content too readily. A convincing impersonation can create a fast path from initial trust to financial loss, mailbox takeover, or wider internal compromise without any exploit chain beyond persuasion.

Failure mechanism: The attacker abuses a trusted communication channel and times the request to match normal work pressure, so the recipient substitutes familiarity for verification and approves an action that should have required stronger confirmation.

Impact: The result can include fraudulent transfer, credential compromise, business disruption, and secondary abuse of the same mailbox or relationship to reach additional systems or teams.

Practitioner Guidance

What to prioritise: Focus first on the transactions that create the most damage when they are approved by email alone, especially payments, password resets, vendor changes, and executive requests. Those are the workflows where a believable message becomes a business event.

What to verify: Confirm that high-risk requests require a second channel or independent approval that is hard to spoof, and check whether support and finance teams have a shared, testable rule for rejecting urgency-driven exceptions.

Common mistake: Treating phishing only as a training problem. The better control is to reduce the number of decisions that an email can authorise on its own, because human suspicion will always vary under pressure.

Practitioner takeaway: The key question is not whether users can spot a fake message, but whether a fake message can still trigger a valuable action before the organisation re-verifies it.

Related resources from NHI Mgmt Group

• Why do AI-generated business email compromise attacks create higher fraud risk than older phishing campaigns?
• Why do compromised email accounts still create business email compromise risk?
• How should organisations reduce business email compromise risk when attackers use generative AI?
• Why do business email compromise and synthetic identity attacks create such high risk for organisations?