What is business email compromise (BEC)?

Business email compromise is a scam where an attacker uses email - either a hacked account or a convincing fake - to trick someone in a business into sending money or sensitive data, and it is one of the costliest cybercrimes facing Australian businesses:

• The classic move - a fake email from the boss or a supplier asking for an urgent payment or a change to bank details.
• Why it works - it relies on trust and urgency, not malware, so antivirus and firewalls never see it coming.
• The invoice variant - an attacker intercepts a real invoice and swaps the bank account, so the payment goes to them.
• The defence - verify any payment or bank-detail change through a second channel, like a phone call to a known number, never by replying to the email.

No technical control stops business email compromise on its own - a simple rule to phone-verify every payment change is what defeats it.