Business email compromise (BEC) is a scam in which criminals pretend to be someone your company trusts, such as a director, supplier, customer or adviser, usually by email, to trick staff into sending money or sensitive information. Unlike mass phishing, a BEC message is often short, well written and carries no attachment or malware. It works by fitting into a normal business conversation at the right moment.
The Hong Kong Police regularly warn companies about business email scams. Small and medium-sized businesses are attractive targets because payments often depend on a few people and informal checks.
How a BEC scam usually works
Most cases follow a few patterns, sometimes combined.
- Supplier bank account change: an email that appears to come from a regular supplier says its bank details have changed and asks you to pay the next invoice to a new account.
- Urgent request from a "boss": a message that looks like it comes from a director asks finance to make a confidential, urgent transfer, often while the real person is travelling.
- Hijacked mailbox: criminals steal a staff member's or supplier's email password, read past conversations and then reply inside a real thread, so the request looks genuine.
- Lookalike domain: the sender address differs from the real one by a single character, such as "rn" in place of "m", or uses a different domain ending.
- Payroll diversion: a request to change an employee's salary account.
Warning signs to watch for
- Any request to change bank account details, especially by email alone.
- Urgency, secrecy or instructions not to call, for example "I am in a meeting, just process it today".
- A sender address, reply-to address or domain that is slightly different from usual.
- Unusual wording, or a request that skips your normal approval steps.
- Emails you did not send appearing in your Sent folder, or forwarding rules you did not set up.
How to reduce the risk
BEC is mainly a process problem, so the strongest defences are payment controls. Technology then makes impersonation harder.
Payment and approval controls
- Call back on a known number: confirm any new or changed bank details by phone, using a number already on file, never one given in the email.
- Two-person approval: require a second person to approve new payees, bank detail changes and payments above a set amount.
- Permission to pause: make it clear that staff will not be blamed for delaying a payment to verify it.
Email and account security
- Turn on multi-factor authentication for every mailbox, starting with finance and management accounts.
- Publish SPF, DKIM and DMARC records so others can detect emails that fake your exact domain.
- Use a password manager so each account has a unique password.
- Tag emails from outside the company, and alert on new mailbox forwarding rules and unusual sign-ins.
- Limit who can create payees or release payments in banking and accounting systems, in line with role-based access control.
Staff awareness
Short, regular reminders work better than one annual talk. Show finance and admin staff examples of the patterns above, and give them one simple way to report anything suspicious. Our guide to phishing covers related tricks.
Illustrative example: an accounts clerk receives an email in an existing thread with a regular supplier, asking for this month's invoice to be paid to a new account because of an "audit". The company rule says bank changes need a call-back, so the clerk phones the supplier's usual contact, who knows nothing about it. The supplier's mailbox had been compromised. This is a hypothetical scenario, not a description of a specific client.
What to do if you think you have been targeted
- Contact your bank at once if money has been sent. Speed matters, although recovery is not guaranteed.
- Report it to the police. In Hong Kong you can call the Anti-Deception Coordination Centre's Anti-Scam Helpline 18222 for advice, and report a case at a police station or through the Police e-Report Centre.
- Keep the evidence: the original emails with full headers, invoices, payment records and call notes.
- Secure the accounts: reset passwords, sign out all sessions, check MFA settings and remove unknown forwarding rules.
- Warn the other party through a trusted channel if a supplier's or customer's email was used.
An incident response plan that names who does each step saves time when it matters.
Frequently asked questions
Do SPF, DKIM and DMARC stop BEC?
They help stop emails that fake your exact domain. They do not stop lookalike domains or messages sent from a genuinely hacked mailbox, so payment checks are still needed.
Is BEC only about email?
No. The same scam can arrive by messaging app, phone call or fake video call. See our article on a deepfake scam verification workflow.
If you would like help reviewing email security, sign-in controls and payment workflows, see our cybersecurity and compliance services. For ongoing monitoring and maintenance with agreed response times, see managed support and SLA.