Every BEC (Business Email Compromise) investigation I've seen follows the same shape. Not the same words, not the same industry, not the same amount of money — but the same six-stage chain. Once you can see the chain, you can see exactly where it breaks. And that's where your defences go.
Here's an anonymised, real-world walk through the whole attack, from the criminal's first keystroke to the money leaving the bank account.
Stage 1: Reconnaissance (days to weeks before the email)
The attack doesn't start with a phishing email. It starts with research, and almost none of it is technical.
- The criminal reads your website, your LinkedIn company page, and your staff's LinkedIn profiles. Names, job titles, reporting lines, who looks like a decision-maker.
- They check public records — company directories, ABN lookups, recent news.
- They note your invoicing style, your suppliers, your payment terms, and who in the business is allowed to approve payments.
At this stage, nothing has been hacked. Your business has been studied.
The reason this matters: the email that arrives weeks later will be frighteningly specific. It will reference a real project, a real person, and a real deadline.
Stage 2: Getting a foothold
To make the next email believable, the attacker needs to send it from somewhere that looks like yours, or from a domain close enough to yours. The common options:
- A lookalike domain — `yourcompany-payments.com`, `yourcompany.co` instead of `.com.au`, or a domain with a single-character typo.
- A compromised external account — a supplier, a client, or a business partner whose credentials were stolen in an earlier, unrelated breach.
- A subdomain takeover — an old project of yours (a staging site, an abandoned app) points to a service the attacker has since registered.
None of these require them to break into your systems. That's what makes BEC so different from a ransomware attack — the breach is external, and your firewall sees nothing unusual.
Stage 3: The phishing email
This is the email your staff will actually see. Read it carefully — notice what's not in it:
Hi Sarah,
>
I'm heading into a board meeting and can't take calls for the next couple of hours. We need to settle the AP invoice for [real supplier] today to keep the discount — I've attached the updated payment details. Please process before 3pm and confirm once done.
>
Thanks,
[Director's name]
No malicious attachment. No suspicious link. No spelling errors. No "Urgent!!!" in all caps. Just a short, plausible, mildly time-pressured request from someone in authority, sent to the one person who can move money.
That's the whole trick. BEC emails are rarely technical. They're behavioural. They exploit trust, hierarchy, and the fear of annoying a senior person.
Stage 4: The human moment
The request lands on a real person's desk — often in accounts, admin, or the office manager. They face a genuinely hard choice:
- The sender looks like the director.
- The reference is accurate.
- There's a deadline.
- Asking for confirmation might look like they're not on the ball.
Most of the time, the human does the right thing and just... does the job. This is not a failure of the person. It's a failure of the process — the process gave one person, based on one email, the power to move significant money with no second check.
Stage 5: The money moves
Once the transfer is approved, the money is typically gone within minutes to hours. The criminal's side of the operation is industrial:
- Funds are sent to an account the attacker controls, often in a different state or country.
- Within the same hour, the money is split across multiple accounts, sometimes converted to crypto.
- By the time the bank fraud team calls, the money is usually untraceable.
This is the stage where businesses discover the uncomfortable truth: payment speed and fraud recovery speed are completely different things. You can undo a transfer in minutes; you cannot undo a criminal's money-mule network.
Stage 6: The aftermath
Detection usually comes from one of three places: the supplier calling to say they haven't been paid, a bank fraud call, or the director asking "why did you pay that early?"
From here: police report, bank fraud claim, insurer notification, forensic review, and a painful board conversation. Average SME losses run into the tens of thousands — and the cost of a near-miss (the email that was caught) is almost always far cheaper than the one that wasn't.
Where the chain breaks: your defences
The good news is that this chain has weak points at every stage. You don't need to block the attack — you just need to break one link.
| Attack stage | What breaks the chain |
|---|---|
| Reconnaissance | Limit what's public on staff LinkedIn profiles; treat your own public footprint as attack surface |
| Foothold | Keep domains you don't use registered; enable SPF, DKIM and DMARC so lookalike domains are flagged |
| The email | DMARC enforcement plus inbox rules that flag external senders claiming to be internal |
| The human | A callback rule: any payment change is confirmed by phone, using a known number — never by replying to the email |
| The money | Two-person approval above a set amount; no single staff member can approve and process a payment change |
| The aftermath | MFA and conditional access everywhere, phishing-resistant where possible, and a written incident response plan so the first hour isn't chaos |
The two controls that stop the most BEC losses, in my experience, are boring: the callback rule and two-person payment approval. Neither requires new software. Both remove the single point of failure that the entire attack depends on.
The quick self-check
If you're not sure where you stand, ask yourself these five questions:
- Can one person approve and process a payment change from a single email?
- Do you have a written rule that payment details are only ever confirmed by phone to a known number?
- Is DMARC actually in place on your domain, or just SPF?
- Do your staff know what to do in the first 15 minutes after they suspect a BEC email?
- When was your last phishing simulation or table-top exercise?
If the answer to any of those is "no" or "I'm not sure", that's a conversation worth having — and it's a conversation you can have cheaply, before it becomes an expensive one.
I run BEC-specific reviews for small businesses: email authentication checks, payment process mapping, and a staff drill that tests the human side of the chain. If you'd like a walkthrough of your own attack surface, get in touch and I'll be back within one business day.