Business email compromise is consistently among the most financially damaging categories of attack, and it is largely invisible to security tooling. There is no payload. The attacker sends a message that is, technically, an ordinary email.
How it actually runs
The pattern is patient. Access to a mailbox is obtained — usually through phishing or credential reuse. The attacker then reads, often for weeks, learning who authorizes payments, how requests are phrased, which suppliers are active, when the finance lead travels.
Then a request is made that fits the context precisely: a genuine supplier, an expected invoice, updated bank details, and language consistent with previous correspondence. It frequently comes from a real internal mailbox, which defeats sender authentication entirely.
Security controls have nothing to act on. The message contains no attachment, no link, no anomalous content. It is a legitimate account sending a plausible message.
Why technical controls only go so far
Multi-factor authentication is the single most effective preventive measure, because it substantially reduces mailbox compromise in the first place. It should be universal, including for service accounts and legacy protocols, which are the usual gaps.
Beyond that, technical controls help at the margins: impersonation detection, external sender marking, anomalous login alerting. Useful, and none of them stop a real account sending a plausible request.
The controls that actually work
Out-of-band verification for payment detail changes. Any change to supplier bank details is verified by calling a number already held on file — never a number supplied in the request. This single control defeats most of the category.
Dual authorization above a threshold, with genuine independence. Two approvers who both act on the same email are one approver.
Explicit permission not to comply. Much of the effectiveness comes from urgency and seniority. Staff need to know, from the top, that verifying a request from an executive is expected behaviour and will never be treated as insubordination. This is a cultural control and it is the one most often missing.
Rehearsed response. Recovery of funds depends on speed measured in hours. Knowing in advance who calls the bank, who preserves the mailbox evidence and who notifies the counterparty is worth having written down before it is needed.