BEC
Fraud that uses a compromised or spoofed business mailbox to trick staff into paying fake invoices, changing bank details or sending data.
BEC relies on trust, not malware. Attackers take over a real mailbox (credential phishing, AiTM proxies that steal session cookies, OAuth consent phishing) or impersonate one with lookalike domains, then insert themselves into payment conversations. Classic tells in a compromised mailbox: new inbox rules that move or delete replies containing "invoice" or "payment", forwarding to external addresses, and sign-ins from unusual infrastructure.
It consistently causes some of the largest reported losses of any cybercrime category in FBI IC3 reporting. DMARC helps only against exact-domain spoofing; compromised genuine mailboxes pass every authentication check.
Investigation centres on identity and mailbox audit logs: sign-in logs, rule creation, OAuth app grants and MailItemsAccessed to determine which messages were read. Controls that matter most are out-of-band verification of bank detail changes and phishing-resistant MFA.