Business Email Compromise (BEC)

Business Email Compromise (BEC) is a targeted social-engineering attack in which threat actors impersonate trusted figures or compromise accounts to induce employees to transfer funds or disclose sensitive data; the report explains BEC variants (CEO fraud, account compromise, attorney impersonation, false invoices, data theft), outlines the attack lifecycle and business impacts (financial loss, operational disruption, reputational and legal consequences), and recommends layered defenses including email authentication (SPF/DMARC/DKIM), MFA, verification processes, security awareness training, and incident response planning.