How to Prevent Business Email Compromise (Before the Fake Invoice Gets Paid)

It’s a Tuesday morning. The finance lead at a growing organization opens an email from a vendor she pays every month. Same logo. Same signature. Same tone. The only change is a line asking her to send this month’s payment to new bank details. Nothing about it looks wrong, and that is exactly why business email compromise works.

Business email compromise (BEC) doesn’t need malware or a dramatic ransom note. It needs one stolen password, a few quiet days inside a mailbox, and an invoice that arrives at the right moment. This guide explains how a BEC attack actually unfolds, the controls that prevent most of them, and how 24/7 managed detection and response stops the ones that get through, before the payment moves.

What is business email compromise?

Business email compromise is fraud that uses a trusted email identity to redirect money or data. The attacker either takes over a real mailbox or sends from a lookalike domain, then asks someone with payment authority to do something that seems routine: pay an invoice, update a vendor’s bank details, buy gift cards, or send payroll records.

You’ll also see it called vendor email compromise, invoice fraud or payment diversion fraud. The names describe the target, not a different attack. The common thread is that nothing technically “breaks.” The email system works, the payment system works, and a real person approves a real payment to the wrong account.

How a business email compromise attack unfolds

Most BEC attacks follow the same pattern. Each step on its own looks minor, which is why they slip past teams that review alerts one at a time.

1. A password is stolen. A colleague clicks a convincing phishing link and enters their Microsoft 365 or Google Workspace credentials on a fake sign-in page.
2. The attacker signs in quietly. They log into the real mailbox, often from another country, and read for days to learn who pays which vendors, when, and how.
3. A hidden inbox rule is added. A rule moves or deletes any reply from the real vendor, so nobody notices the conversation has been hijacked.
4. A lookalike domain is registered. The attacker sets up a domain one letter off from the vendor’s and copies their logo and email signature.
5. The invoice arrives on schedule. The finance team gets a familiar-looking invoice with “updated” bank details, timed to the normal payment cycle.
6. The money moves. A wire or ACH transfer goes out. By the time the real vendor asks why they weren’t paid, the funds are usually gone.

Why most security tools miss it

Every one of those steps leaves a trace. The problem is where the traces land:

What happened	Where it shows up	How it looks alone
Sign-in from an unusual country	Identity logs (Entra ID, Google Workspace)	A low-priority travel alert
New rule hiding vendor replies	Mailbox audit log	A routine settings change
Invoice from a lookalike domain	Email filtering	One message among thousands
Request to change bank details	A person’s inbox	Normal vendor admin

Separately, none of these looks urgent. Together, they describe an account takeover heading straight for a wire transfer. Catching BEC is less about any single tool and more about someone connecting the dots across identity, email and endpoints, in time to act.

How to prevent business email compromise: 9 controls that work

No single control stops every BEC attempt, but layered together these close the gaps attackers rely on. Most cost little beyond process discipline.

Process controls (your finance team)

• Call back on every bank-detail change. Verify any new or changed payment instructions by phone, using a number you already have on file, never one from the email requesting the change.
• Require two people for payment changes. One person requests a new payee or bank account, a second approves it. Attackers count on one busy person acting fast.
• Treat urgency as a warning sign. “Pay today,” “keep this confidential” and “the CEO needs this now” are pressure tactics. Build a culture where pausing to verify is expected, not punished.

Technical controls (your IT and security team)

• Enforce MFA everywhere, and harden it. Multi-factor authentication stops most password-only takeovers. Use number matching or phishing-resistant methods to blunt MFA-fatigue attacks.
• Block automatic forwarding to external addresses. Attackers love silent forwarding rules. Turn external auto-forwarding off by default.
• Alert on new inbox rules. A rule that deletes or redirects messages from a vendor or a finance contact deserves immediate review.
• Publish SPF, DKIM and DMARC at enforcement. These records make it much harder for anyone to spoof your own domain to your customers and vendors.
• Watch for lookalike domains. Flag inbound mail from domains that are one character off from your vendors or your own brand.
• Run phishing simulations and short training. People who have practiced spotting a fake sign-in page are far less likely to hand over credentials.

These controls reduce your exposure dramatically. What they can’t do is guarantee that nobody ever clicks. That’s where detection and response comes in.

How managed detection and response stops BEC in progress

Managed detection and response (MDR) puts a 24/7/365 security operations center (SOC) on your environment. Instead of logging each event separately, MDR correlates telemetry across endpoints, identities, email, cloud and network, so a strange sign-in, a new inbox rule and a suspicious invoice are recognized as one attack.

When Boom Logic’s SOC confirms a business email compromise, the containment playbook runs under authority agreed in writing before go-live, so nobody waits for a meeting:

• Block sign-in on the compromised account, revoke its sessions and tokens, and reset MFA
• Remove malicious inbox rules, forwarding rules and rogue app consents
• Purge the fraudulent message from every mailbox it reached
• Block the sender and the lookalike domain
• Warn your finance team before the payment goes out

Boom Logic’s MDR commitments are written into the service terms: 30-minute acknowledgment and 1-hour containment, backed by service credits, with the first 24 hours of incident response included. You hear about verified threats, not every alert a tool produces, and you get a full incident report for leadership, counsel and your insurer.

MDR comes standard in Boom 365: MSSP Pro and Boom 365: MSSP Enterprise, delivered by our SOC as a Service. Not sure how MDR differs from an MSP or MSSP? Our guide to MSP vs. MSSP vs. MDR breaks it down.

What to do if a fraudulent payment already went out

Speed matters more than anything else. If you suspect a payment was diverted:

1. Call your bank immediately and ask them to recall or freeze the transfer. The first hours give you the best chance of recovery.
2. Report it to the FBI’s Internet Crime Complaint Center at ic3.gov, and notify your cyber insurance carrier.
3. Secure the compromised mailbox. Reset the password, revoke active sessions, re-enroll MFA and remove any inbox or forwarding rules you didn’t create.
4. Preserve the evidence. Keep the emails, headers and sign-in logs. Your insurer, your bank and law enforcement will ask for them.
5. Warn the real vendor. They may be compromised too, or other customers may be receiving the same fake invoice.

Nonprofits and clinics are prime BEC targets

Grant disbursements, donor gifts and vendor payments make nonprofits and community health centers attractive to BEC attackers, often with smaller finance teams and less security coverage. Qualifying 501(c)(3) organizations with 20 or more endpoints can get the same 24/7 SOC and MDR through Boom 365: MSSP Pro at a discount via the Nonprofit IT Empowerment Program (NITEP).

Would your team have connected the dots?

Find out what would be caught in your environment today, and what wouldn’t. Every organization gets a free security assessment covering detection gaps and prioritized findings. Organizations with 25 or more staff or endpoints also get a complimentary external penetration test and phishing simulation under a signed rules-of-engagement agreement.

Prefer to talk it through? Call 833-BOOM-338.