Phishing and business email compromise

22 May 2026 · 11 min read

Business email compromise is the most expensive cybercrime most people have never heard of. It rarely involves malware, it almost never trips a virus scanner, and it does not need to break into your network. It just needs one person to read a convincing email and do what it says. That is why it works, and that is why the losses are enormous: the FBI's Internet Crime Complaint Center has tracked tens of billions of dollars in reported BEC losses over the past decade, and those are only the cases that get reported.

This guide explains how phishing and business email compromise actually work, where the money goes, and how a layered defence, with DMARC at enforcement as the foundation, removes the single most useful tool an attacker has: the ability to send mail that appears to come from your own domain.

What phishing and BEC actually are

It helps to separate two related ideas, because people use the words loosely and the defences differ.

Phishing is the broad category: any message designed to trick a recipient into doing something against their interest. Clicking a link to a fake login page, opening an attachment, entering credentials, approving a multi-factor prompt. Phishing is usually high volume and somewhat generic. It is cast wide and relies on a small percentage of people taking the bait.

Business email compromise (BEC) is a targeted subset that specifically abuses trust between people who do business together. There is often no malicious link or attachment at all. The "payload" is a request: pay this invoice, change these bank details, buy these gift cards, send me the payroll file. Because there is nothing technically malicious in the message, content filters that hunt for bad URLs and dodgy attachments frequently see nothing to flag.

The key insight is that BEC is a confidence trick wearing the costume of a routine business email. The attacker's most powerful prop is the identity in the From header. If they can make a message look like it genuinely came from your CEO, your supplier, or your finance team, the social engineering does the rest.

The techniques attackers use

Attackers have a toolkit of impersonation methods, and they pick whichever defeats your current defences. Understanding each one tells you exactly which control stops it.

Exact-domain spoofing

This is the purest attack and the one DMARC was built to stop. The attacker sends mail with your real domain in the From address, for example cfo@yourcompany.com, from a server that has nothing to do with you. SMTP, the protocol that carries email, lets any server claim to be sending from any address. There is no built-in check. Without authentication controls, a message saying it is from your finance director can arrive looking completely legitimate, with your real domain, in the recipient's inbox.

If your domain has no DMARC policy at enforcement, this attack is essentially free for the criminal. You can test your own domain right now with the DMARC checker to see whether you are exposed.

Lookalike and cousin domains

When exact-domain spoofing is blocked, attackers register a domain that looks almost right at a glance. Common tricks include:

• Character swaps that read the same in a hurry: rn instead of m, the digit 1 instead of l, 0 instead of o.
• Different top-level domains: yourcompany.co instead of yourcompany.com, or yourcompany-invoices.com.
• Homoglyphs from other alphabets that render identically to Latin characters.

DMARC does not stop a lookalike domain, because the message genuinely comes from a domain the attacker controls and can authenticate. The defence here is brand monitoring, user training, and, increasingly, BIMI, which only displays your verified logo on mail from your real authenticated domain so a lookalike simply will not show it. See /products/bimi for how that visual trust signal works.

Display-name spoofing

Many mail clients, especially on mobile, show only the friendly display name and hide the actual address. An attacker sets the display name to Jane Smith, CEO while the underlying address is jane.smith.ceo@gmail.com or some throwaway account. The recipient sees a familiar name and never checks the address behind it. This bypasses domain authentication entirely because the attacker is not claiming to be your domain at all. Training and clear "external sender" warnings are the countermeasures.

Compromised account takeover

The hardest variant to detect: the attacker gains access to a real mailbox, often through an earlier phishing campaign that harvested a password, then sends from inside it. The mail is genuinely authenticated, genuinely from the real domain, and often continues a real conversation thread. This is why supplier accounts are such valuable targets. Defences here move beyond email authentication into multi-factor authentication, anomaly detection, and out-of-band verification of payment changes.

Thread hijacking and reply-chain abuse

A sophisticated extension of account takeover. Having read the victim's mailbox, the attacker inserts themselves into an existing, legitimate email thread at exactly the right moment, for example when an invoice is genuinely due. The context is real, the history is real, only the new bank details are fraudulent. This exploits the trust built up over a real relationship and is devastatingly effective against accounts payable teams.

A worked example of a BEC attack

Concrete beats abstract, so here is how a typical supplier-invoice fraud unfolds.

1. Reconnaissance. The attacker scrapes LinkedIn and your website to learn who works in finance, who their managers are, and which suppliers you use. Press releases about new contracts are gold for this.

1. Initial access. They phish a junior account at a supplier you work with, perhaps with a fake document-sharing email leading to a credential-harvesting page. The supplier has weak or no MFA, so the password works.

1. Lurking. Inside the supplier's mailbox, the attacker sets a quiet inbox rule to forward or hide certain messages and watches the flow of invoices for weeks. They learn the language, the amounts, the timing.

1. The strike. When a genuine invoice for, say, 48,000 pounds is about to be sent to you, the attacker either edits the real invoice's bank details or replies in the existing thread: "Please note our banking has changed, kindly remit to the account below."

1. The payout. Your accounts payable team sees a real invoice, in a real thread, from a real and authenticated supplier address. They pay. The money lands in a mule account and is moved within hours, often through several jurisdictions, before anyone notices.

Notice that in this scenario, exact-domain spoofing was never used against you. But in a huge proportion of cases, the very first step, the initial phishing email, is exactly where exact-domain spoofing of a trusted brand does the heavy lifting. Make spoofing your domain impossible and you remove yourself from that supply chain of attacks, protecting both you and everyone who trusts mail from your name.

The financial and operational impact

The headline is money, but the damage is broader.

• Direct financial loss. BEC routinely produces five- and six-figure single transactions, sometimes far more. Recovery is rare once funds are moved, because there is no malware to trace, only a series of authorised bank transfers.
• Reputational damage. If your domain is used to phish your own customers, partners, or the public, the brand harm and erosion of trust outlast the incident. People stop trusting mail from you.
• Operational disruption. Incident response, forced password resets, legal and regulatory reporting, and the freeze on payment processes while controls are reviewed all carry real cost.
• Regulatory and compliance exposure. Depending on jurisdiction and sector, a breach involving personal data or customer funds can trigger mandatory reporting and penalties.
• Deliverability collateral damage. Domains that are heavily spoofed accumulate poor sending reputation, which quietly pushes your legitimate mail towards spam folders even when you have done nothing wrong.

That last point matters because email authentication is not only a security control. The same mechanisms that block spoofing also tell mailbox providers that your real mail is genuinely yours, which protects your inbox placement. For a fuller picture of what major providers now demand, see /requirements.

The layered defence

There is no single switch that makes phishing and BEC disappear. Effective protection is layered, and the layers reinforce each other. Here is how they fit together, from the technical foundation outward to people.

Layer one: email authentication (SPF, DKIM, DMARC)

This is the foundation, and it is where you have the most direct control. Three standards work together.

SPF (Sender Policy Framework) publishes, in DNS, the list of servers allowed to send mail for your domain. A receiving server checks whether the sending IP is on that list. SPF alone is fragile: it breaks when mail is forwarded, and it only checks the hidden envelope sender, not the visible From address a human reads. Check yours with the SPF checker, and learn more at /products/spf.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message using a private key, which receivers verify against a public key in your DNS. It proves the message was authorised by your domain and was not altered in transit, and it survives most forwarding. Test a selector with the DKIM checker and read /products/dkim.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the layer that ties the other two to the visible From address and tells receivers what to do with mail that fails. This is the crucial piece. SPF and DKIM authenticate technical identifiers, but DMARC requires that one of them passes and aligns with the domain in the From header that the recipient actually sees. That alignment is what defeats exact-domain spoofing. Read more at /products/dmarc.

A DMARC record carries a policy:

• p=none means monitor only. Mail is not blocked, but you receive reports. This is the diagnostic starting point, not the destination.
• p=quarantine means failing mail should go to spam or be held.
• p=reject means failing mail should be refused outright at the server, never reaching the inbox.

Enforcement means p=quarantine or, ideally, p=reject. A domain sitting on p=none indefinitely gets the visibility but none of the protection. Exact-domain spoofing only becomes impossible at p=reject. You can generate a starter record with the DMARC generator.

Layer two: reaching enforcement safely

Here is the catch that traps many organisations. Move straight to p=reject without preparation and you risk blocking your own legitimate mail: the newsletter platform, the invoicing system, the helpdesk, the HR tool, every service that sends "on your behalf" but was never properly authenticated. The result is a self-inflicted email outage.

The safe path is methodical:

1. Publish p=none with reporting addresses so receivers send you aggregate data.
2. Collect and read the reports. These XML reports reveal every source sending mail under your domain, the good and the bad. Feed them into the DMARC report analyzer to turn the raw XML into a clear picture.
3. Authenticate every legitimate sender. For each real service, set up SPF inclusion and DKIM signing so it passes and aligns.
4. Step up the policy gradually, often via p=quarantine with a percentage tag, watching reports at each stage to confirm no legitimate mail is caught.
5. Reach p=reject once the reports show only illegitimate sources failing.

This is precisely the journey a done-for-you service exists to manage. Taking a domain from p=none to p=reject with no email outage is the core promise of DMARC Engine, and ongoing monitoring with change alerts means you find out the moment a new sender appears or a record is altered.

Layer three: transport and brand reinforcement

Two further standards harden the edges.

MTA-STS (Mail Transfer Agent Strict Transport Security) forces inbound mail to your domain to be delivered over an encrypted, authenticated TLS connection, closing the door on certain interception and downgrade attacks. Check it with the MTA-STS checker and see /products/mta-sts.

BIMI (Brand Indicators for Message Identification) displays your verified brand logo beside authenticated mail in supporting clients. It requires DMARC at enforcement first, which is the point: it turns your hard authentication work into a visible trust signal customers can see, and it makes display-name and lookalike tricks more obvious because the fakes never carry the logo. Verify readiness with the BIMI checker and read /products/bimi.

Layer four: people and process

Technology removes the easiest attacks and forces criminals onto the harder, costlier ones such as account takeover and lookalike domains. The final layer addresses what is left.

• Out-of-band verification for money movement. Any change to payment details or any unusual payment request must be confirmed through a separate channel, a phone call to a known number, never a number supplied in the email itself. This single process control stops most successful BEC cold.
• Multi-factor authentication everywhere. This is what prevents the credential-phish that leads to account takeover. Without it, one stolen password becomes a foothold.
• External-sender banners. A clear visual marker on mail from outside the organisation helps people spot display-name spoofing and cousin domains.
• Realistic, blame-free training. Teach staff the specific BEC patterns: urgency, secrecy, changed bank details, requests that bypass normal process. The goal is a culture where pausing to verify is rewarded, not penalised.
• A reporting habit. Make it easy and consequence-free to report a suspicious message. Early reports turn a single near-miss into an organisation-wide warning.

How the layers map to the attacks

It is worth restating which control stops which technique, because this is what makes the case for doing all of it.

• Exact-domain spoofing is stopped by DMARC at p=reject with aligned SPF and DKIM. Nothing else fully closes it.
• Lookalike and cousin domains are blunted by brand monitoring, user training, external banners, and the visual contrast of BIMI on your genuine mail.
• Display-name spoofing is caught by training and external-sender warnings, since it does not claim your domain.
• Account takeover is prevented upstream by MFA and detected by anomaly monitoring; the resulting fraud is stopped by out-of-band payment verification.
• Thread hijacking is the hardest, and out-of-band verification of any payment-detail change is the reliable backstop.

Read the list again and the pattern is clear. Email authentication does not solve everything, but it is the load-bearing wall. It eliminates the cheapest, highest-volume attack, it protects your domain from being used as a weapon against others, and it is the prerequisite for the visual trust signals on top. Skip it and every other layer is doing more work than it should.

Where to start

If you do one thing after reading this, find out whether your domain can be spoofed right now. Run it through the free DMARC checker, and while you are there, look at the full set of free diagnostics at /tools to check your SPF, DKIM, MTA-STS, and BIMI posture in a few minutes.

If the checker shows you are on p=none or have no DMARC record at all, you are exposed to exact-domain spoofing, and the priority is reaching enforcement without breaking your legitimate mail. That is a careful, reports-driven process, and it is exactly what the done-for-you DMARC Engine service handles end to end, with continuous monitoring and change alerts so your protection does not quietly drift. To brush up on any term used here, the glossary has plain-language definitions.

Phishing and BEC succeed by borrowing trust. Take away an attacker's ability to wear your domain, layer the human and process controls on top, and you turn your email from a liability into something recipients can actually rely on.