TL;DR:

  • Business email compromise (BEC) — where attackers impersonate executives, suppliers, or colleagues to redirect payments — is now consistently one of the highest-value cyber crimes hitting UK SMEs
  • The attacks don’t need malware or technical hacking; they rely on convincing emails, and the financial pressure to act quickly
  • The defences are procedural and free: payment verification processes, email authentication (DMARC), and staff awareness of the specific patterns attackers use

If you asked most small business owners what cybersecurity threats they were worried about, they’d probably say ransomware or getting hacked. Business email compromise (BEC) often doesn’t come up — but it should. Action Fraud regularly reports BEC as one of the highest-loss cybercrime categories for businesses in the UK, with individual incidents running into tens or hundreds of thousands of pounds.

Here’s the thing about BEC: it doesn’t require sophisticated malware, vulnerability exploitation, or technical skills. It requires a convincing email and a recipient who doesn’t verify before acting. That combination is easy to manufacture, and the attacks are getting harder to spot.

What BEC Actually Looks Like

There are a few standard patterns, and it’s worth knowing them specifically because recognition is the first line of defence.

CEO fraud / executive impersonation. An email arrives that appears to be from your managing director or CEO, addressed to the person who controls payment authorisation. It requests an urgent bank transfer — a supplier needs to be paid immediately, there’s a legal settlement, something sensitive that shouldn’t go through the normal approval process. The urgency and the request to keep it confidential are standard features. The email might be from a spoofed address (e.g. ceo@yourcompany-hq.com instead of yourcompany.com) or, in more sophisticated attacks, from the actual CEO’s email account if it’s been compromised.

Supplier impersonation / invoice fraud. An email arrives that appears to be from a regular supplier — one your accounts team deals with frequently — informing you that their bank account details have changed. All future invoices should go to the new account. This is often timed to coincide with a real invoice, making it more believable. Once you’ve paid the fraudulent account, recovering the money is very difficult.

Payroll diversion. An email arrives in HR or payroll appearing to be from an employee, asking for their salary payment to go to a new bank account. By the time the real employee notices their pay hasn’t arrived, the money has been moved.

What these have in common: they’re designed to create urgency, invoke authority, bypass normal processes, and complete before anyone notices something is wrong.

Why They’re Getting More Convincing

BEC attacks have always relied on social engineering, but 2026 versions are increasingly using AI to improve quality. Generic phishing emails full of grammatical errors are still common, but targeted BEC attacks are now often grammatically perfect, written in the appropriate register for the relationship, and reference real details — your company name, the correct name of your CEO, a real supplier you use.

That contextual detail comes from LinkedIn, company websites, Companies House, and in some cases from prior access to email or document systems. Attackers research their targets. A well-researched BEC email to a small business finance person can be genuinely difficult to distinguish from a legitimate request.

The Verification Habit That Stops Most BEC

The most effective defence against BEC is a simple procedural rule: any request to transfer money or change payment details gets verified by calling the requestor on a known number — not by replying to the email or using a number provided in the email.

This sounds obvious when you write it down. It’s surprisingly easy to skip in practice, especially when the email conveys urgency from a senior person. That’s exactly what attackers are counting on.

Some practical implementations:

  • Any payment above a defined threshold (say, £500 or £1,000) requires verbal confirmation with the requestor
  • Bank account change requests require confirmation via a phone number already in your records, not from the notification
  • Finance staff have explicit permission (and encouragement) to delay urgent payment requests until they can verify — even if the request appears to come from the owner

This last point matters. Staff who feel pressured to act quickly on financial requests without questioning them are a vulnerability. A clear policy that says “verification is always allowed and expected” removes the social pressure that BEC exploits.

Email Authentication: DMARC Makes Spoofing Harder

BEC attacks using a spoofed version of your own domain — where the From: field shows ceo@yourcompany.com but the email actually comes from an attacker’s server — are stopped by DMARC.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with email that fails authentication checks. Combined with SPF and DKIM records, DMARC at p=reject means emails falsely claiming to come from your domain are rejected before they reach recipients.

Setting this up requires access to your domain’s DNS — your web host or IT provider can do it, or you can follow NCSC’s guidance, which includes step-by-step instructions for common email providers. It won’t stop attacks from lookalike domains (yourcompany-hq.com, yourcompany.co) but it does stop impersonation of your exact domain.

The NCSC’s Mail Check tool (check.ncsc.gov.uk) will tell you the current state of your domain’s email authentication in about thirty seconds.

What to Do If It Happens

If you realise you’ve transferred money as a result of a BEC attack:

  1. Call your bank immediately — they may be able to recall the payment if it hasn’t been moved. Speed matters enormously here. The UK has a Contingent Reimbursement Model (CRM) that provides some protection for authorised push payment fraud, but time is critical.

  2. Report to Action Fraud (actionfraud.police.uk) — this creates a case reference and contributes to intelligence that may help recover funds or identify the attackers.

  3. Preserve the evidence — don’t delete the email, take screenshots, note the bank details you sent money to.

  4. Review your email security — if the attack worked by compromising your CEO’s actual email account, you have an access control problem to address (check for suspicious login activity, enable MFA if it wasn’t enabled).

The NCSC also has an incident response guide for businesses at ncsc.gov.uk/guidance/small-business-guide-response-recovery.

BEC isn’t a technical attack you defend against with security software. It’s a social attack you defend against with clear processes, staff awareness, and the confidence to slow down and verify before you pay.