What Is Business Email Compromise?
Key takeaways
- Business email compromise is usually committed from a genuine inbox, so the presence of a real domain and a correct signature proves very little.
- Payment detail changes are the highest-value target, which is why any change to a supplier's bank account must trigger an out-of-band callback.
- DMARC with an enforcing policy and SPF and DKIM aligned tell receiving servers which senders are genuinely yours, and blocks most spoofed invoice mail.
- The finance and accounts team is the point of failure, so the verification rule has to be written into the process rather than left to judgement.
- In India a successful payment fraud is reported to cybercrime.gov.in or the 1930 helpline, and the bank must be informed immediately to raise a recall.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What is business email compromise and how does the attack work?
Business email compromise, often called invoice fraud or CEO fraud, is the use of a real or convincing email identity to move money or extract data. There are two common shapes. The first is the compromised mailbox: the attacker steals a supplier's or an executive's account with a phished password, waits for a genuine transaction thread, and then sends one or two new instructions changing the bank account. The second is the lookalike domain: an address that differs by one character, or a display name set to the real person, so the reply goes to the attacker.
How do you spot a business email compromise attempt?
Look for four patterns. The urgency: a deadline today, a board meeting, a supplier strike. The channel shift: the request arrives by email but asks you to call a number, or the reply comes from a different address than the thread. The secrecy: you are asked not to discuss it with colleagues. The abnormality: a new bank account, a new contact, a request to bypass the normal approval, or an attachment with a one-time password request. The rule for Indian teams should be simple: any change to payment details is verified by voice on a number already held in records, never on a number supplied in the message, and no payment goes out on a first-time recipient without that call.
What technical controls reduce business email compromise?
Four, working together. First, phishing-resistant login on the mail account, because the attack almost always begins with a credential. Second, DMARC with SPF and DKIM aligned, published at enforcement policy, so that spoofed senders are rejected rather than delivered to the inbox, and so that you can see who is sending in your domain. Third, an email security gateway with impersonation protection, which catches display-name spoofing and newly registered lookalike domains. Fourth, mail flow rules that quarantine external invoice attachments and auto-route requests that mention bank details to a second reviewer.
What do you do after a business email compromise payment?
Move in the first hour. Call the bank's fraud department and request a recall of the transfer, because money can often be frozen if the receiving account has not been withdrawn from, and the recall is faster than the police process. Then file on the National Cyber Crime Reporting Portal and the 1930 helpline, and preserve the full evidence: the email headers, the original message, the thread, the payment details and the bank's reference. Reset the credentials of the compromised mailbox, revoke sessions and remove any forwarding or payment rules the attacker created. Check whether the attacker read other threads, because a compromised inbox usually contains the trust relationships needed for a second wave.
| Stage | What the attacker does | Control that stops it | Owner |
|---|---|---|---|
| Initial access | Phishes a mailbox password or abuses a stolen session | Phishing-resistant login and conditional access | IT team |
| Persistence | Adds a forwarding or payment rule in the mailbox | Server-side rules review and alerting on rule changes | IT team |
| Impersonation | Sends from the real domain or a lookalike domain | DMARC at enforcement, plus impersonation protection | IT team |
| The request | Asks for a transfer, a new payee or a changed bank account | Callback verification on a number already on file | Finance team |
| The payment | Moves money to an account the attacker controls | Dual approval above a threshold, and a recall if missed | Finance team |
What are the frequently asked questions?
Get a straight answer on this
Send us your current invoice and approval process, and we will return a fixed-price business email compromise assessment with a DMARC and verification checklist.
Send us the details See pricing