TL;DR:

  • Business email compromise (BEC) involves criminals hijacking or spoofing email accounts to redirect payments — it’s responsible for significant financial losses to UK SMEs every year
  • The attack works by compromising or impersonating a legitimate email account, then sending convincing fake payment instructions at the right moment
  • DMARC, DKIM, and SPF on your domain are the technical controls that stop the spoofing variant, and they’re free to implement
  • Always verify any change to payment details through a separate, known contact method before transferring money

In April 2026, a UK energy company lost £700,000 in a single transaction. No malware. No ransomware. No sophisticated exploit. A criminal compromised the company’s email, waited for a conversation about an upcoming supplier payment, and swapped in their own bank details. The money went to a fraudulent account before anyone noticed anything was wrong.

This is business email compromise, and it’s one of the most financially damaging fraud types targeting UK businesses right now. It’s not especially technical. It doesn’t require the victim to click anything suspicious. It exploits the fact that businesses trust email and move money based on instructions received through it.

How BEC Actually Works

There are two main variants, and they’re often confused with each other.

In the first variant, the criminal actually gains access to a legitimate email account, usually through phishing or credential theft from a data breach. They then monitor the account silently, watching for conversations about payments, contracts, or supplier relationships. When a payment is imminent, they intervene with convincing instructions to redirect it. Because the email genuinely comes from the compromised account, it passes spam filters and looks completely legitimate.

In the second variant, the criminal doesn’t need to compromise an account at all. They create a convincing lookalike email address — perhaps swapping a letter, adding a hyphen, or using a different TLD — and rely on the target not noticing. This works better than you’d expect, especially when the email arrives at a busy moment and the target is expecting communication from that contact.

Both variants typically target a specific trigger event: an upcoming payment, a new supplier relationship, or an invoice for work that’s just been completed. The criminal either knows about this from monitoring a compromised account, or they’re guessing based on the normal cadence of business activity.

Why It Works on Small Businesses Specifically

Small businesses are disproportionately affected because the payment controls that large organisations have in place (dual authorisation for transfers over a threshold, procurement systems with supplier bank detail verification) simply don’t exist in most SMEs. Payment decisions often sit with one person, verification is informal, and the volume of supplier invoices is low enough that each one doesn’t get rigorous scrutiny.

The trust relationships are also different. A company with 10 employees probably has the MD and finance function sitting close together, and payment instructions often come through informal channels like WhatsApp or email without formal approval processes. That informality is what criminals exploit.

The Controls That Actually Work

On the technical side, the most important thing you can do is protect your own domain from being spoofed. DMARC, DKIM, and SPF are email authentication standards that, when properly configured, prevent criminals from sending email that appears to come from your domain. Setting these up is free — it’s a DNS configuration change, not a paid service — and your IT person or domain registrar can help you do it. Check your current DMARC record at mxtoolbox.com; if there’s nothing there, you have no protection against someone spoofing your domain.

For email account security, multi-factor authentication is non-negotiable. If someone phishes your password, MFA means they can’t access your email account to monitor and intercept communications. Enable MFA on every email account in your business, not just the finance function.

On the process side, the single most effective control is a verification rule: any change to payment bank details must be confirmed by phone, using a number from your existing records or the supplier’s official website, before the payment is made. Not email. Not WhatsApp. A call. This breaks the attack even when the email appears completely genuine.

The same rule applies to urgent payment requests that arrive by email only, especially ones that involve the MD or a senior person asking someone to make a payment quickly and quietly. This pattern — urgency, authority, secrecy — is a BEC hallmark.

What to Do If You’re Targeted

If you send a payment and then realise it may have gone to a fraudulent account, speed is everything. Call your bank immediately using the number on the back of your business card and ask them to issue a recall on the payment. Banks have a process for this and it does sometimes work, particularly within the first few hours.

Report to Action Fraud on 0300 123 2040 or at actionfraud.police.uk. If the attack involved access to your email account (rather than just spoofing), treat it as a security incident: change passwords, check what else was accessed, and consider alerting any suppliers or customers who might have also received fraudulent communications purportedly from you.

Your bank may cover losses through the APP (Authorised Push Payment) fraud reimbursement scheme, which now covers most UK consumers and many small businesses. The rules on business eligibility vary by bank, but it’s worth asking.

The NCSC has detailed guidance on BEC at ncsc.gov.uk/collection/phishing-attacks. Their Business Email Compromise guide covers both the technical controls and the process changes in plain language.

The Uncomfortable Truth

Most BEC victims did nothing obviously wrong. They were busy, they trusted a familiar email address, and the request seemed plausible in context. The criminal spent weeks monitoring their inbox to make it plausible.

The defences aren’t difficult. DMARC on your domain, MFA on your email accounts, and a phone call to verify any bank detail change. These three things together address the vast majority of BEC attacks. The question is whether they’re in place before the attempt, not after.