A business email compromise (BEC) is a cyber crime that utilizes
access to an organization's email to defraud that
organization and its employees, customers, or partners. BEC attacks
can take a variety of forms and can be sophisticated and complex. A
common example is a targeted phishing attack in which a malicious
attacker conducts sufficient reconnaissance to deliver a type of
email message the employee would expect to receive in the regular
course of their occupation. It may request that they enter their
user credentials to use an application that they would commonly
use. In doing so, they unwittingly provide their user credentials
to the malicious attacker. The attacker then logs on to the
account, intercedes in email communication with a vendor, changes
an account number on payment information, and causes payment to be
transferred to the attacker's account.
