Business email compromise, or BEC, is fraud that rides on trusted email: an attacker controls or convincingly imitates a real mailbox and uses it to redirect money, steal data or gain access. Engineers matter because they own the systems, tokens and mail rules that make the trick work.
Two ways in
Most BEC starts one of two ways. In the first, the attacker takes over a real account. Microsoft's guidance on compromised mailboxes describes attackers using a compromised user's mailbox to send to recipients inside and outside the organization, and calls BEC a prolific type of attack.
In the second, no account is taken. The attacker registers a lookalike domain or forges a display name and writes as the CEO, a vendor or a colleague. The message is plausible because it copies a real relationship.
The first kind is harder to spot, since the mail truly comes from the right address and often arrives inside an existing thread.
Why engineering is in scope
It is easy to file BEC under finance. That misses three things.
Engineers administer the mail and identity systems. Forwarding rules, external forwarding policy, sign-in logs and MFA enrolment are all things someone on your team can inspect or change.
Engineers are targets too. Access to source control, cloud consoles and package registries is worth more to some attackers than a wire transfer. A takeover of a developer mailbox can lead to password resets for those systems.
Engineers write the workflows around payments, vendor onboarding and access requests. If a vendor can change bank details through a plain email, that is a design gap, and it can be closed with process.
What the attack looks like after a takeover
Microsoft's write-up of an adversary in the middle campaign shows the pattern. After stealing a session, the attacker searched the mailbox for finance related threads, deleted the original phishing email, and created an inbox rule that moved mail from the fraud target to the Archive folder and marked it read. Replies inside payment threads were then used to redirect funds, and the attacker removed the replies from Sent Items.
The write-up notes that payment fraud began as quickly as five minutes after credential and session theft. Speed is the reason detection that only runs weekly is too slow.
Controls that map to the attack
- Phishing-resistant sign-in for mail, so a stolen password or relayed code is not enough. See which MFA to require.
- Alerts on new inbox rules and new external forwarding, since both show up in real incidents.
- A written rule that bank detail changes are confirmed by phone, using a number already on file. See the vendor payment checklist.
- Sender authentication on your own domains so nobody can forge you. See SPF, DKIM and DMARC setup.
- An easy way to report a suspicious message. See the reporting process.
Quick check
Is BEC always a hacked mailbox?
No. Some cases involve a real compromised account, others use a spoofed or lookalike address. Both rely on trust in a familiar sender.
Does MFA stop BEC?
It stops many takeovers, but session theft through a proxy phishing page can get past some MFA methods. Phishing-resistant methods close that gap.
Sources
- Respond to a compromised email account in Microsoft 365
- From cookie theft to BEC: attackers use AiTM phishing sites as entry point to further financial fraud
Last reviewed: 19 October 2026.
