The Anatomy of a Business Email Compromise Attack From Start to Finish

June 7, 2026 • BizVuln Expert

A detailed, step-by-step breakdown of how Business Email Compromise (BEC) attacks unfold, from initial reconnaissance to final payout, with actionable detection and prevention strategies for MSSPs and business leaders.

The Anatomy of a Business Email Compromise Attack From Start to Finish

Business Email Compromise (BEC) is not a single moment of deception—it is a carefully orchestrated campaign that exploits human trust, organizational processes, and technical blind spots. Unlike ransomware or malware-driven attacks, BEC relies almost entirely on social engineering and identity manipulation. In 2024, the FBI’s Internet Crime Complaint Center (IC3) reported over $2.9 billion in adjusted losses from BEC attacks, making it one of the most financially devastating cyber threats for organizations of all sizes.

For MSSPs, security consultants, and business owners, understanding the full lifecycle of a BEC attack is critical—not just to recognize the warning signs, but to build layered defenses that disrupt each phase. This post dissects a typical BEC attack from the attacker’s initial reconnaissance through the final fraudulent transfer, highlighting the key indicators, exploitation techniques, and countermeasures you can implement with your BizVuln MSSP platform.

Phase 1: Reconnaissance and Target Selection

Every BEC attack begins with intelligence gathering. Attackers do not blindly spray phishing emails; they identify high-value targets inside an organization—typically employees with access to financial systems, payroll, invoicing, or sensitive vendor relationships. Common targets include CFOs, controllers, accounts payable managers, executive assistants, and HR directors.

Methods of Reconnaissance

• Open-source intelligence (OSINT): Attackers scour LinkedIn, company websites, press releases, and SEC filings to map out organizational hierarchies, reporting structures, and key personnel. They look for recent promotions, departures, or acquisitions that create confusion.
• Harvested email addresses and signatures: Data breaches and email harvesting tools (e.g., from underground markets) provide attackers with valid corporate email addresses and even email signature templates that imitate exact formatting.
• Social media monitoring: Attackers track executive travel schedules, conference attendance, or personal events (e.g., a CEO on vacation) to time their approach when the real executive is unreachable or distracted.
• Domain and email security scanning: Attackers test for SPF, DKIM, and DMARC misconfigurations to determine if spoofed emails will pass authentication checks.

BizVuln Threat Intelligence Insight: Your MSSP platform can automate OSINT scanning by monitoring changes in executive roles and flagging newly discovered domain vulnerabilities. By integrating public breach data with your customer’s email environment, you can preemptively identify which accounts are most likely to be impersonated.

Phase 2: Initial Contact and Email Compromise

Once the target is selected, the attacker either spoofs a trusted identity or compromises a legitimate account. Two primary vectors exist:

2a. Spoofing (Domain Impersonation)

Attackers register lookalike domains—often swapping a letter (e.g., company.co vs company.com), adding a suffix (company-security.com), or using a free email provider with a display name identical to the executive’s. Emails appear to come from a known sender but fail to pass DMARC validation if properly configured.

2b. Account Takeover (ATO)

More sophisticated attacks compromise a legitimate employee’s email credentials—usually via credential phishing (e.g., a fake Office 365 login page), password spraying, or session cookie theft. Once inside, the attacker gains full access to the mailbox, calendar, contact lists, and even archived conversations. They can monitor ongoing threads and reply in the victim’s voice.

Example: An attacker compromises the email of a mid-level finance analyst. They quietly set up inbox rules that forward all emails containing words like “invoice”, “wire”, or “ACH” to an external address, while moving the company’s own security alerts to the trash or archive.

Detection Indicators for MSSPs

• Unexpected email forwarding rules (especially to external domains)
• Login anomalies—access from unusual IPs, VPN exit nodes, or geographies
• Sudden changes in email signatures or display names
• SPF/DKIM alignment failures on inbound messages

BizVuln Countermeasure: Deploy automated anomaly detection across your tenant’s Microsoft 365 or Google Workspace logs. BizVuln’s threat intelligence feeds correlate login IPs with known threat actor infrastructure and flag inbox rule changes in real time.

Phase 3: Establishing Trust and Context

After gaining a foothold, the attacker studies the compromised inbox to understand communication patterns, payment cycles, and internal jargon. They may lurk silently for days or weeks, reading threads to learn who signs off on invoices, what dollar amounts are routine, and how finance teams request approvals.

In many BEC attacks, the attacker will send short, low-stakes test messages to verify the compromised account still works or to see if the target replies promptly. They may also initiate a separate conversation under the guise of the compromised user to establish rapport with a colleague in finance.

For example, a fake CEO might email the CFO: “Hi, are you available for a quick chat later? I need to authorize a time-sensitive payment.” This technique, known as “CEO fraud,” leverages authority and urgency to bypass critical thinking.

Social Engineering Tactics Used:

• Urgency and confidentiality: “This is confidential and must be processed immediately—vendor is waiting.”
• Authority pressure: “I’m in a meeting and can’t be reached by phone. Please only email me.”
• False consensus: “Susan from accounting is already aware—she’ll confirm if needed.”
• Personalization: Referencing real projects, dates, or dollar amounts gleaned from hacked emails.

Phase 4: The Request – Creating the Narrative

Now comes the payoff. The attacker crafts a credible request for a fraudulent wire transfer, ACH payment, or gift card purchase. Common narrative themes include:

• Vendor payment change: “Our vendor ABC Corp has changed banking details. Please update the record and pay the invoice to the new account attached.”
• Acquisition closing: “We are acquiring a company and need to wire the escrow deposit by end of day to this law firm trustee account.”
• Executive travel emergency: “I’m stuck overseas and need an urgent wire to cover expenses before the flight tomorrow.”
• Payroll diversion: “I changed direct deposit information; please update my profile and reissue this month’s payment to the new account.”

The email often includes a PDF with “new” bank details that look legitimate—real bank names, routing numbers, and even fake letterhead. The attacker banks on the recipient not verifying the change via a separate communication channel.

Technical Triggers to Watch

• Presence of attached PDF or Excel files containing bank details (not inline text)
• Reply-to header modified to an external domain
• Email threading that does not match the previous conversation flow
• Unusual time of day for the sender (e.g., 2 AM local time for a CEO)

Phase 5: The Execution – Moving Money

If the victim complies, the attack succeeds—and the money moves quickly. Once the wire is sent, typically to a domestic or international account controlled by money mules (often unwitting or complicit individuals), the funds are quickly transferred through multiple accounts or cryptocurrency exchanges to launder the trail.

In sophisticated BEC rings, the attacker may execute multiple requests over several days, each for moderate amounts to avoid triggering anti-money laundering limits. They may also follow up with a “confirmation” email from a second compromised account to validate the transaction and lull the finance team into a false sense of security.

Typical timeline from initial compromise to wire:

• Reconnaissance: 2–5 days
• Account takeover or spoof: 1 day
• Context building: 3–14 days
• Request made: 1 day
• Funds transferred: Within 4–24 hours of request

Once the money leaves the bank, recovery is extremely difficult, especially if the transfer crosses international borders. The FBI advises reporting within 72 hours for potential recall, but success rates are low.

Phase 6: Aftermath – Covering Tracks

After the transfer, the attacker may delete the original email threads, remove forwarding rules, or even log out of the compromised account to avoid detection. If the victim later discovers the fraud, the attacker may pivot to a secondary vector—like sending a follow-up phishing email to the same victim claiming to be from “IT Security” investigating a “breach” and requesting credentials.

In some cases, the attacker returns weeks later to attempt a second payout, assuming the organization has not implemented stronger controls. BizVuln’s continuous monitoring ensures that even post-attack residual risks—such as lingering inbox rules or hidden forwarders—are surfaced during follow-up assessments.

Preventing BEC: A Layered MSSP Defense Strategy

No single tool stops all BEC attacks. A 2023 Ponemon Institute study found that organizations with integrated email security, user training, and insider threat detection reduced BEC losses by 64%. For MSSPs and business owners, the following controls are essential:

1. Email Authentication & Domain Hardening

• Enforce strict DMARC rejection policies (p=reject) on all domains.
• Implement BIMI (Brand Indicators for Message Identification) to display verified logos.
• Deploy DMARC reporting and analysis to identify unauthorized sending sources.

2. Multi-Factor Authentication (MFA) Resistant to Phishing

• Move beyond SMS-based MFA; use FIDO2 security keys or number-matching push notifications.
• Enforce conditional access policies that require MFA for all financial personnel on every session.

3. Anomaly Detection & Behavioral Analytics

• Monitor for impossible travel (login from New York and London within 30 minutes).
• Alert on first-time external forwarding rules, especially to free email domains (gmail, outlook.com).
• Track unusual email sending patterns—mass internal BCC, late-night activity, or replies to old threads.

4. Out-of-Band Verification for Financial Transactions

• Require in-person or phone verification (using a known, pre-established number) for any change in vendor banking details or wire requests over a threshold.
• Implement a “two-person rule” for initiating and approving payments.

5. Employee Training with Simulation

• Conduct regular phishing simulations that include BEC scenarios (e.g., spoofed CEO emails).
• Train finance teams on “red flags” like urgent secrecy requests, direct deposit changes, and supplier bank detail updates.

6. BizVuln MSSP Integration

BizVuln’s threat intelligence platform stitches these capabilities together. By ingesting email logs, identity provider events, and financial system audit trails, your MSSP can create a unified BEC detection dashboard. Automated incident response playbooks can quarantine suspicious emails, disable compromised accounts, and alert the CISO within seconds. Additionally, our predictive threat modeling identifies which of your customers’ domains are most at risk for lookalike registration and suggests proactive domain defensive registration.

Conclusion

Business Email Compromise is not a technology failure—it is a process failure. Attackers exploit gaps in verification, training, and monitoring, not cryptographic weaknesses. For MSSPs and security consultants, the key to defending clients lies in understanding the attack’s anatomy and deploying commensurate defenses at each stage.

By combining email authentication, behavioral analytics, user education, and out-of-band verification, you can shrink the window of opportunity for attackers. And with BizVuln’s threat intelligence capabilities, you gain the visibility needed to detect BEC before the wire is sent. Start auditing your customer’s email security posture today—because in BEC, the best defense is knowing the attack before it happens.

Interested in seeing how BizVuln can help you protect your clients from Business Email Compromise? Schedule a demo to see our threat intelligence module in action.