Preventing Business Email Compromise Fraud in Banks: Red Flags and Response
Business email compromise fraud does not use malware, does not trip an antivirus alert, and rarely touches your bank's firewall. It succeeds by manipulating trust inside an ordinary-looking email thread. For IIBF Prevention of Cyber Crime candidates and working bankers alike, preventing business email compromise fraud starts with understanding exactly why it slips past every control that is built to catch a virus. This article walks through the anatomy of a BEC attack, its four common variants, the two defences that actually work, the role of SPF, DKIM and DMARC, what a bank does when a payment must be recalled, and where the incident gets reported once it is discovered.
🕵️ Anatomy of a BEC Attack
Every BEC attack begins quietly, well before any fraudulent email lands in an inbox. The attacker spends days or weeks on reconnaissance: LinkedIn profiles reveal who reports to whom, a company website lists the CFO's name and email format, out-of-office auto-replies confirm when the CEO is travelling, and press mentions of a pending acquisition hint at a large payment that is due soon. This groundwork lets the fraudster write an email that sounds exactly right for the moment.
Delivery then follows one of two paths. The first is a spoofed lookalike domain — a near-identical address such as swapping a letter, adding a hyphen, or using a different top-level domain, sent from outside the organisation. The second, far more dangerous route, is a genuinely compromised mailbox: the attacker has stolen real credentials through prior phishing, is sitting inside the actual inbox, and replies mid-thread on a live conversation. Because the mail truly originates from the real server, authentication checks pass and the message looks completely legitimate.
The final stage is the payload itself — not a file, but words: an urgent tone, a tight deadline, a request for confidentiality, and a fraudulent payment instruction pointing to a new or "updated" beneficiary account. Study the broader channels of cyber crimes chapter to see how email fits alongside other attack vectors that examiners test together.
🎭 Four Faces of BEC: CEO Fraud, Vendor, Payroll and Attorney Scams
BEC fraud is not one script; it is a family of impersonation plays, each aimed at a different desk in your organisation. CEO fraud targets finance staff directly — an email that appears to be from the CEO or MD demands an urgent, confidential wire transfer, leaning on authority and time pressure to bypass normal questioning. Vendor invoice redirection exploits a routine payment cycle: the attacker, often from a compromised supplier mailbox, sends "updated bank account details" just ahead of a genuine invoice that was already due.
Payroll diversion works the other direction — an email impersonating an employee asks HR or payroll to change the salary account before the next pay run, redirecting the employee's own wages. Attorney impersonation poses as external counsel handling a confidential acquisition or litigation matter, pairing legal authority with secrecy demands to discourage the victim from verifying through normal channels. All four rely on the same weakness: a human being trusts an email enough to skip a phone check.
| BEC Variant | Impersonates | Typical Ask | Malware Used |
|---|---|---|---|
| CEO Fraud | CEO / Managing Director | Urgent, confidential wire transfer | ❌ No |
| Vendor Invoice Redirection | Known supplier | Updated beneficiary bank account | ❌ No |
| Payroll Diversion | Employee / HR contact | Change of salary account before payday | ❌ No |
| Attorney Impersonation | External lawyer | Confidential deal-related fund transfer | ❌ No |
Understanding these variants alongside the wider study of computer fraud protection gives you the pattern-recognition examiners expect.
🛡️ Why Signature-Based Controls Miss BEC
Antivirus engines, endpoint detection tools and email sandboxes are all built around one assumption: that an attack carries malicious code — a payload, a macro, a link to an exploit kit. BEC carries none of this. It is plain text exploiting a process gap, not a technical one, so there is simply nothing for a signature scanner to match against. This is precisely why ransomware attacks on banks and BEC fraud demand entirely different defensive playbooks even though both start in the inbox.
The controls that actually work are procedural, not technical. Callback verification means picking up the phone and calling the counterparty on a number pulled from your own prior, independently verified records — never a number supplied inside the suspicious email itself. Dual authorisation applies the maker-checker principle banks already use elsewhere: any change of beneficiary account, or any high-value payment, needs a second, independent officer to approve it before release, so one persuaded employee cannot move money alone.
💡 Exam Tip: BEC is a process-control problem, not a technology problem. Expect questions that test whether antivirus, firewalls or malware scanners are relevant here — they are not.
Network-layer defences such as firewall controls in banking networks protect the perimeter but sit entirely outside the BEC kill chain, since no malicious traffic ever needs to cross that boundary.
🔐 SPF, DKIM and DMARC Explained
Three email-authentication standards work together to blunt the spoofed-domain half of the BEC problem. SPF (Sender Policy Framework) publishes, in DNS, exactly which mail servers are allowed to send email for a domain — a receiving server can check whether the sending server is on that approved list. DKIM (DomainKeys Identified Mail) cryptographically signs outgoing mail, so any tampering with the message in transit breaks the signature and gives it away.
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the two together: it tells the receiving mail server what to do when SPF or DKIM checks fail — quarantine the message, reject it outright, or simply monitor — and sends reports back to the domain owner about spoofing attempts. Configured properly, DMARC stops most lookalike-domain attacks before they reach an inbox.
⚠️ Common Mistake: Assuming DMARC alone eliminates BEC risk. It stops domain spoofing, but does nothing once an attacker has taken over a genuine mailbox — the mail is authentic, so it passes every check.
That gap is why human verification remains essential even on a fully DMARC-enforced domain, and why chapters on computer hackers pair naturally with BEC study — account takeover is a hacking outcome, not a spoofing one.
📋 Bank Response: Recall, Stop-Payment and Reporting
The moment BEC is suspected, speed decides the outcome. The bank should immediately raise a recall or stop-payment request through the relevant payment rail — an NEFT/RTGS recall, or a SWIFT recall message for cross-border transfers — with the beneficiary bank, rather than waiting for further confirmation. If the funds have not yet been withdrawn, the beneficiary bank can place a hold pending investigation. Every email header, timestamp and login trail should be preserved as evidence; this is the same discipline covered in our guide to electronic evidence in banking fraud cases.
Reporting runs on parallel tracks. Qualifying cyber incidents must be reported to CERT-In, India's nodal cyber security agency, within the mandated timelines under its cyber incident reporting directions. The affected party can also report through the national 1930 cyber crime helpline or the cybercrime.gov.in portal, which is the fastest route to a fund-freeze request at the receiving bank. Legally, BEC fraud typically attracts provisions under the IT Act, 2000 — such as identity theft and cheating by personation — alongside applicable provisions of the criminal law. Internally, this entire response sits under the bank's incident management process, which is worth revising alongside this topic.
The golden rule is simple: recall requests filed within minutes of a fraudulent transfer have by far the best chance of freezing funds before withdrawal, so escalation speed matters as much as the technical control itself. Bankers should also remain alert to adjacent risks — a caller impersonating a known counterparty can now be aided by AI voice cloning, a technique explored further in our piece on deepfake fraud in banking, which is exactly why callback numbers must come from your own records and not from the call itself.
Conclusion: Building a BEC-Resistant Payment Process
Preventing business email compromise fraud is ultimately a discipline of process, not a purchase of software. Get reconnaissance-aware about what your own organisation exposes publicly, enforce SPF, DKIM and DMARC to close the spoofing route, and make callback verification plus dual authorisation non-negotiable for every beneficiary change or high-value payment. When an incident does happen anyway, speed of recall and correct reporting to CERT-In and the 1930 helpline determine whether the money comes back. Explore more topics in the Prevention of Cyber Crime hub, and test yourself with chapter-wise mocks before exam day.
🧠 Practice MCQs: Preventing Business Email Compromise Fraud
Q1. What primarily distinguishes a business email compromise (BEC) attack from a typical malware-based cyber attack? (a) BEC always uses a ransomware payload (b) BEC relies on social engineering and impersonation, without deploying malicious code (c) BEC only targets individual retail customers (d) BEC is reliably detected by antivirus signatures
Answer: (b) — BEC exploits trust and process gaps rather than malicious code, so signature-based tools have nothing to detect.
Q2. In the "vendor invoice redirection" variant of BEC, the fraudster typically: (a) Demands a ransom to decrypt vendor files (b) Sends an "updated bank account" instruction just ahead of a routine invoice payment (c) Impersonates a customer applying for a loan (d) Hacks the vendor's point-of-sale terminal
Answer: (b) — The attacker times a fake account-change email to intercept a payment that was genuinely due.
Q3. Which control is considered the most effective defence against a BEC-driven fraudulent payment instruction? (a) Installing a stronger antivirus on finance-team laptops (b) Callback verification using a previously recorded, independently sourced phone number (c) Blocking all external email attachments (d) Increasing email server storage quota
Answer: (b) — Calling a number from prior verified records, never one supplied in the suspicious email, defeats impersonation directly.
Q4. DMARC builds on SPF and DKIM primarily to: (a) Encrypt the body of every email in transit (b) Tell receiving mail servers what action to take when SPF/DKIM checks fail, and report back to the domain owner (c) Scan attachments for malware signatures (d) Replace the need for dual authorisation on payments
Answer: (b) — DMARC sets the enforcement policy (quarantine/reject) and provides visibility into spoofing attempts against the domain.
Q5. Under India's cyber incident reporting framework, a bank that suspects a BEC-driven fraudulent transfer should, among other steps: (a) Wait for the customer to file a police complaint before acting (b) Report the incident to CERT-In and initiate a payment recall with the beneficiary bank without delay (c) Report to IIBF only during the annual audit (d) Ignore incidents below a set currency threshold
Answer: (b) — Immediate recall plus mandated CERT-In reporting together give the best chance of limiting loss.
Want chapter-wise mock tests with 100+ MCQs? Start practising free →
What is business email compromise (BEC) fraud?
BEC is a social-engineering fraud where an attacker impersonates a trusted party by email — a CEO, vendor, payroll contact or lawyer — to trick an employee into making an unauthorised payment or changing beneficiary account details, without using any malware.
Why can't antivirus software stop BEC attacks?
Because BEC emails typically carry no malicious attachment or link; the attack is the wording and impersonation itself, so signature-based and sandbox tools have nothing to detect.
What is the difference between a spoofed lookalike domain and a compromised mailbox in BEC?
A spoofed domain is a fake, similar-looking address the attacker controls, which SPF, DKIM and DMARC can often catch. A compromised mailbox is the victim's real account taken over by the attacker, so authentication checks pass because the mail genuinely originates from that domain.
Where should a bank report a suspected BEC fraud in India?
Alongside internal escalation and payment recall, qualifying incidents are reported to CERT-In, victims can use the 1930 national cyber crime helpline or the cybercrime.gov.in portal, and offences may attract provisions under the IT Act such as identity theft and cheating by personation.
Practice this topic
Take a free mock test, download chapter PDFs, or watch a video class — all included on iibf.store.
