# Business email compromise (BEC)

Business email compromise (BEC) is fraud in which an attacker uses a hijacked or spoofed company mailbox to make staff pay fake invoices or change bank details.

## How it works

The attacker either takes over a real mailbox (often after credential phishing) or uses a look-alike domain, then joins an existing conversation about payments.

The request comes at a plausible moment and from a trusted sender, so it bypasses the usual suspicion of phishing emails.

## How to protect yourself

- Confirm any change of bank details by phone using a number you already had.
- Publish DMARC with enforcement for your domains and monitor look-alike registrations.

## Related tools

- [Email Header Parser](https://phishdestroy.io/developer-tools/email-header-parser)
- [Email Authentication Checker](https://phishdestroy.io/developer-tools/email-auth-checker)
- [Lookalike Domain Generator](https://phishdestroy.io/developer-tools/lookalike-generator)

## Related terms

- [DMARC](https://phishdestroy.io/glossary/dmarc/)
- [SPF](https://phishdestroy.io/glossary/spf/)
- [DKIM](https://phishdestroy.io/glossary/dkim/)
- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)

## Further reading

- [Why Email-Only Abuse Reports](https://phishdestroy.io/why-email)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/bec/