How phishing opens the door to business email compromise

### Executive summary This briefing explains how phishing and business email compromise (BEC) relate—phishing often provides the initial access while BEC uses targeted, context-aware social engineering to cause fraudulent transactions (notably SOC-observed attempts targeting Workday payroll and direct deposit). It emphasizes key BEC characteristics (impersonation of trusted insiders, contextualized messaging, urgency), notes that AI is making deception more convincing, and recommends employee awareness and SOC/defensive measures to reduce risk.