Business Email Compromise (BEC) is the most financially damaging cyber threat facing Indian businesses today. Unlike ransomware or data breaches — which are visible, disruptive events — BEC attacks are quiet. An employee receives what looks like an email from their CEO, CFO, or a trusted vendor. They act on it. By the time anyone realises something is wrong, money has already been transferred, credentials have been shared, or sensitive data has been forwarded.
This guide explains exactly how BEC works, why standard email filters cannot stop it, and what Indian businesses can do to protect themselves.
What is Business Email Compromise?
Business Email Compromise is a category of email fraud where attackers impersonate a trusted person or organisation to manipulate employees into taking a specific action — usually transferring money, purchasing gift cards, sharing login credentials, or sending sensitive data.
The FBI classifies BEC as the costliest form of cybercrime globally. In India, the Cyber Crime Coordination Centre (I4C) has documented thousands of crore in BEC losses annually, with incidents concentrated in manufacturing, IT services, logistics, real estate and professional services firms.
The defining characteristic of BEC is that it does not rely on malware, malicious attachments, or known phishing URLs. The email itself is clean — it is the social engineering element that makes it dangerous. This is precisely why standard spam filters and antivirus software cannot detect it.
How BEC Attacks Work — The Five Types
The FBI identifies five distinct BEC attack categories:
1. CEO Fraud
The most common BEC type. An attacker impersonates the CEO or a senior executive and sends an urgent email to someone in finance or HR, instructing them to:
- Transfer money to a new bank account
- Purchase gift cards and send the redemption codes
- Pay an invoice immediately, bypassing normal approval processes
The email appears to come from the CEO — the display name is correct, the writing style is plausible, and the request sounds urgent enough to bypass normal verification.
Example Indian scenario: An accounts payable executive at a Pune manufacturing firm receives an email appearing to be from the Managing Director at 4pm on a Friday, requesting an immediate RTGS transfer of ₹45 lakh to a "new vendor account" for a "confidential acquisition." The executive completes the transfer. The MD's email was spoofed.
2. Vendor or Invoice Fraud
The attacker compromises or impersonates a supplier or vendor that the business regularly transacts with. They then send a legitimate-looking invoice — often for a real transaction — but with the bank account details changed to an account they control.
This type of BEC is particularly effective because:
- The vendor name is real and trusted
- The invoice amount matches a known pending payment
- The only change is the bank details (IFSC code, account number)
Example Indian scenario: An importer in Mumbai receives an email that appears to be from their regular US-based supplier, requesting that future payments be made to a new bank account "due to a bank change." The email uses the same signature and email format as the real supplier. The attacker had compromised the supplier's email account weeks earlier and was monitoring correspondence for the right moment.
3. Account Compromise
A legitimate employee email account is compromised — via phishing, credential stuffing or malware — and the attacker uses it to send BEC emails to customers, partners or colleagues from the inside.
This is the hardest BEC variant to detect because the email comes from a real, trusted internal account. Barracuda's lateral phishing detection is specifically designed to catch this variant.
Why this is dangerous: Because the email is genuinely from the compromised account, it bypasses almost every email security control. SPF, DKIM and DMARC all pass — the email is technically authentic. Only behavioural analysis (unusual sending patterns, unusual request types, unusual recipient lists) can flag it.
4. Attorney / Legal Impersonation
The attacker impersonates a lawyer, CA, or legal counsel handling a "sensitive and confidential matter." The urgency and confidentiality framing is designed to bypass normal approval processes:
"This is a confidential legal matter and cannot be discussed through normal channels. Please process this payment immediately to avoid legal consequences."
This type of BEC often targets companies involved in mergers, acquisitions or legal disputes.
5. Data Theft BEC
Rather than requesting a money transfer, the attacker requests sensitive data — employee PII, salary information, client lists, or tax documents. This data is then used for identity theft, follow-on fraud, or sold on dark web marketplaces.
Why Standard Email Filters Cannot Stop BEC
This is the critical question for most IT decision-makers evaluating email security.
Standard spam filters operate on:
- IP reputation (is this IP on a blocklist?)
- Domain reputation (is this domain known to be used for spam?)
- Content scanning (does this email contain known malicious URLs or attachments?)
- DMARC/DKIM/SPF authentication checks
BEC attacks bypass all of these because:
| Filter mechanism | Why BEC bypasses it |
|---|---|
| IP reputation | BEC emails often sent from legitimate email providers (Gmail, Outlook, Yahoo) |
| Domain reputation | The attacker uses a lookalike domain (c1oudfy.com vs cloudfy.com) that has never sent spam before |
| Content scanning | The email contains no malicious URLs or attachments — it is plain text with a social engineering request |
| SPF/DKIM/DMARC | Display-name spoofing uses the correct name but a different email address — authentication passes |
The only technology that can reliably detect BEC is AI-powered impersonation detection — machine learning models trained on billions of emails to identify suspicious patterns in display names, sending domains, writing style and request types.
The Anatomy of a BEC Email
Here is what makes a BEC email convincing:
Display name spoofing:
The attacker sets the "From" display name to "Rajesh Sharma, CEO" while the actual sending address is something like ceo.rajesh@gmail-business.net. Most email clients — especially on mobile — show only the display name, not the actual email address.
Lookalike domains:
The attacker registers cloudfy-india.com or c1oudfy.com (lowercase L replaced with numeral 1) and sends from rajesh@cloudfy-india.com. The email passes SPF and DKIM for the lookalike domain — there is nothing technically wrong with it.
Urgency and authority: The request is always urgent ("today only", "before 5pm", "I'm in a meeting and can't talk") and comes with implied authority ("I need you to handle this confidentially without the usual process this once").
Minimal text: BEC emails are deliberately brief to avoid pattern matching. A CEO fraud email may be as short as two sentences.
Red Flags Your Team Should Know
Train every employee to look for these signals before acting on any email requesting money, credentials or sensitive data:
- Urgency + unusual request — "I need this done before EOD, no time to discuss"
- Bypass normal process — "Don't go through the usual approval, just handle it directly"
- Confidentiality instruction — "Keep this between us for now"
- Unusual payment destination — new bank account, international wire, gift cards
- Mobile-only viewing — always check the actual email address, not just the display name, especially on mobile
- Slight domain variation — hover over any email address from a "senior executive" or vendor and check the full domain character by character
- Grammar that is slightly off — even sophisticated BEC emails sometimes contain subtle language errors
How to Protect Your Business Against BEC
Layer 1 — AI-Powered Email Security
The most important protection is a dedicated email security platform with AI impersonation detection:
- Sophos Email Security Advanced — ML models detect display-name spoofing, lookalike domains and BEC patterns in real time before email is delivered
- Mimecast Email Security — Targeted Threat Protection includes impersonation detection and DMARC Analyser
- Barracuda Email Protection — API-native for M365; catches both external BEC and lateral phishing from compromised internal accounts
- Proofpoint Email Security — TAP + VAP analysis identifies your most attacked employees and applies heightened scanning
All of these platforms add BEC detection that Google Workspace and Microsoft 365's built-in filters do not provide.
Layer 2 — DMARC Enforcement
DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving mail servers what to do with emails that fail SPF or DKIM authentication. At enforcement level (p=reject), any email failing authentication is rejected — preventing domain spoofing.
Most Indian businesses run DMARC in monitoring mode (p=none), which provides visibility but no protection. Moving to p=quarantine and ultimately p=reject closes one of the most common BEC attack vectors.
Read our full DMARC setup guide for India →
Layer 3 — Multi-Factor Authentication (MFA)
Account compromise BEC starts with a compromised employee credential. MFA on every email account (Google Workspace admin-enforced 2FA, Microsoft 365 Conditional Access with MFA) prevents attackers from accessing email accounts even if they have the password.
Layer 4 — Verification Procedures
Technical controls alone are not enough. Implement these procedures for high-risk actions:
- Dual approval for all payments above a threshold — any wire transfer, RTGS or NEFT above ₹50,000 requires approval from two authorised signatories
- Out-of-band verification — any change to vendor bank details must be confirmed via a phone call to a known number, not a reply to the same email thread
- CFO/CEO callback rule — any payment request from a senior executive must be verbally confirmed before processing, regardless of how urgent the email appears
Layer 5 — Security Awareness Training
BEC exploits human psychology, not technical vulnerabilities. Regular phishing simulation and security awareness training significantly reduces the likelihood of an employee falling for a BEC attack.
Both Barracuda and Proofpoint include built-in security awareness training and simulated phishing modules. Standalone training tools like KnowBe4 or Proofpoint Security Awareness Training are also available.
What to Do if Your Business Has Been Hit by BEC
If money has already been transferred as a result of a BEC attack:
- Contact your bank immediately — most banks have a recall process for recent wire transfers; speed is critical; a same-day recall has a much higher success rate than one filed the next day
- Report to cybercrime.gov.in — the National Cyber Crime Reporting Portal; file a complaint within hours, not days
- Contact I4C (Indian Cyber Crime Coordination Centre) — they work with banks and law enforcement to freeze mule accounts
- Preserve all evidence — do not delete any emails, even the fraudulent ones; preserve full email headers
- Notify your cyber insurance provider if you have a cyber policy
Do not assume the money is gone — immediate action significantly improves recovery odds.
FAQs
Is BEC a type of phishing?
BEC is related to phishing but is a distinct category. Phishing typically involves malicious links or attachments sent to many recipients. BEC is targeted, involves no malware, and relies entirely on social engineering and impersonation. Standard anti-phishing tools often miss BEC because there is nothing technically malicious in the email.
Can BEC happen on WhatsApp or phone too?
Yes — BEC has expanded beyond email. Attackers also impersonate executives via WhatsApp (using the executive's photo as a profile picture), SMS and phone calls. The email-based version is the most common because email provides a written trail that looks official and can be forwarded through an organisation's approval processes.
Does Cloudfy provide BEC protection?
Yes. Cloudfy deploys and manages Sophos Email Security, Mimecast, Barracuda and Proofpoint — all of which include AI-powered BEC and impersonation detection. We also handle SPF/DKIM/DMARC configuration for every email security deployment.
How long does it take to deploy BEC protection?
For an MX gateway deployment (Sophos, Mimecast, Proofpoint): 2–4 hours for the technical deployment + up to 48 hours for DNS propagation. For Barracuda's API-native deployment (no MX change): under 2 hours. There is no email downtime during any of these deployments.
As an authorised email security partner in India, Cloudfy provides BEC protection assessments for businesses across India. Contact us to understand your current exposure and get a recommendation tailored to your email environment.