Business Email Compromise: The Email May Contain No Malware at All
The most dangerous business email may contain no virus at all. Sometimes the attack is simply a believable request to change where money is sent.
GonePhishing Scam Prevention & Awareness Insight
What Is Business Email Compromise?
Business Email Compromise (BEC) is fraud that uses impersonated or compromised email accounts to manipulate employees into sending money, changing payment information, releasing payroll data, or sharing sensitive information.
Why This Scam or Tactic Works
Traditional security tools may not flag a message that contains no malicious link or attachment. The attack succeeds by making the request itself believable.
A Realistic Example
A real vendor mailbox is compromised. The attacker watches a legitimate invoice conversation and then replies with “updated” wiring instructions. Because the message appears inside the existing thread, the change seems authentic.
Warning Signs to Watch For
- Change in bank or wire instructions
- Request sent from a familiar account but with unusual wording
- Pressure to complete payment quickly
- A new reply-to address or changed contact information
- Request to bypass established approval steps
How to React
The goal is not to argue with the caller, sender, or website. The safest response is usually to slow the situation down, end the contact if necessary, and create a new trusted path for verification.
- Verify payment changes outside email
- Use a known phone number from existing records
- Alert finance and security when a vendor mailbox may be compromised
- Delay payment until verification is complete
- Preserve the email thread and headers
What You Can Say
You do not need to accuse anyone of being a scammer. A short, calm response can give you the space you need to verify.
“We verify all bank-detail changes by phone using the number already on file.”
“I cannot process new payment instructions based on email alone.”
How to Avoid This Type of Scam
- Use callback verification for vendor changes
- Require dual approval for large payments
- Train employees to inspect sender and reply-to addresses
- Use MFA on business email accounts
What to Do If You Already Responded or Took Action
If money, passwords, account access, or personal information may be involved, act quickly and focus on the most important risk first.
- Contact the sending bank immediately and request a recall or fraud review
- Notify the real vendor
- Preserve all correspondence and transaction details
- Review mailbox rules, logins, and forwarding settings if your organization may be compromised
For broader recovery guidance, visit What to Do After a Scam. If you are not sure whether a message or situation is suspicious, use the GonePhishing Scam Lookup.
Related Scam Prevention Articles
- Fake Invoice Scams: A Company Logo Does Not Make an Invoice Legitimate
- CEO Fraud: Why Employees Must Be Allowed to Verify Urgent Executive Requests
- Urgency Scams: Why “Act Now” Is a Warning Sign
- Bank Impersonation Scams: When the “Bank” Is Not Your Bank
FAQ
Does BEC require malware?
\nNo. Many BEC attacks rely primarily on social engineering and impersonation.
\nCan a real vendor account be used?
\nYes. A compromised vendor account can make fraud much harder to spot.
\nWhat single control helps most with payment changes?
\nIndependent verification using trusted contact information is extremely important.
\nBuild safer habits with practical training: Start Business Email Compromise Training