A supplier sends new bank details. A director asks for an urgent wire transfer. An employee requests that their salary be paid into a different account.
The email looks genuine. The timing seems plausible. The request may even fit an ongoing business conversation.
This is business email compromise (BEC): fraud where criminals use a real or impersonated email account to trick an organisation into sending money, changing payment details or revealing sensitive information.
For BVI businesses, BEC is particularly relevant to trust companies, law firms, financial services firms, property managers, construction companies and shipping suppliers. Many rely on email to manage invoices, client funds, contractors and international wire transfers. A convincing message can therefore create a financial risk very quickly.
What is business email compromise?
Business email compromise is a type of fraud involving the impersonation or compromise of a trusted person or organisation.
An attacker may:
- Take control of a Microsoft 365 mailbox.
- Spoof a sender's address.
- Register a look-alike domain.
- Impersonate a director, client, lawyer or supplier.
- Intercept an existing email conversation.
- Use information gathered from websites and social media to make a request appear genuine.
BEC does not always involve malware or a suspicious attachment. Sometimes the attacker simply sends a well-written email from a legitimate account. This is why it can be difficult to detect.
The FBI's 2025 IC3 Annual Report recorded 24,768 reported business email compromise complaints and more than US$3 billion in reported losses. These figures are global and do not represent a BVI-specific incidence rate, but they demonstrate the scale of the problem.
How BVI businesses lose money through BEC
1. A supplier's bank details are changed
A construction or shipping supplier sends an email explaining that its bank account has changed. The message includes a genuine-looking invoice and asks the business to update its records before the next payment.
The attacker may have compromised the supplier's mailbox or created a similar address. The payment goes to the criminal's account rather than the supplier.
This can continue for several invoices before anyone notices.
2. A "director" requests an urgent payment
An attacker impersonates a managing director or senior partner and asks an employee to make an urgent wire transfer.
The email may say that the director is in a meeting, travelling or dealing with a confidential acquisition. The employee is told not to call because the matter is sensitive.
Urgency and secrecy are deliberate pressure tactics. They are designed to bypass normal approval procedures.
3. A client or supplier's mailbox is compromised
The attacker gains access to a client's or supplier's real mailbox. They then monitor conversations and wait for the right moment to intervene.
Because the message comes from a genuine account and refers to a real project, invoice or transaction, ordinary email filters may not identify it as suspicious.
4. Payroll is redirected
Payroll fraud uses the same weakness as invoice fraud. An attacker impersonates an employee and asks HR or finance to change their salary account.
If the change is accepted based only on email, the next salary payment may go to the criminal.
Payroll redirection can be especially difficult to recover because it may not be discovered until the employee checks their payslip or bank account.
How attackers research their targets
BEC is often prepared carefully rather than sent at random.
Attackers may review:
- Your company website and staff biographies.
- LinkedIn profiles and job titles.
- Public contact details for finance or accounts teams.
- Social media posts about travel, projects or office closures.
- Tender documents, press releases and supplier information.
- Previous data breaches containing email addresses and passwords.
- Email signatures and invoice formats.
They may also monitor a compromised mailbox for weeks. This gives them enough information to copy the language, timing and context of genuine business communications.
In the BVI, public information about professional services, property developments, shipping activity or client relationships can help attackers build a believable story. Busy periods, staff holidays and the operational distraction of hurricane season can make unusual requests harder to challenge.
Why email filters and antivirus are not enough
Traditional email security remains important, but it cannot solve BEC by itself.
Antivirus is designed primarily to detect malicious software. Many BEC emails contain no malware at all. They may be plain text messages sent from a legitimate account.
Email filters can identify suspicious links, attachments, spoofing attempts and known malicious senders. However, a compromised Microsoft 365 account may have a good reputation and pass many technical checks.
A genuine supplier's mailbox can still send a fraudulent payment instruction.
That is why BEC protection needs several layers:
- Strong identity security.
- Proper email authentication.
- Staff training.
- Clear payment approval procedures.
- Independent verification.
Practical defences against business email compromise
Use SPF, DKIM and DMARC
These three email authentication controls help protect your domain from being spoofed.
- SPF identifies which email servers are authorised to send messages for your domain.
- DKIM adds a digital signature to outgoing messages.
- DMARC tells receiving mail systems what to do when a message fails authentication and provides reporting.
Microsoft's email authentication guidance explains how these controls work together.
They reduce the risk of criminals pretending to send email from your domain. However, they will not stop a criminal using a genuinely compromised supplier mailbox, so they must be combined with payment verification and MFA.
Require MFA and phishing-resistant sign-in
Multifactor authentication should be enabled for every Microsoft 365 user, with particular priority for:
- Directors and senior managers.
- Finance and HR staff.
- Global administrators.
- Users with access to client or financial records.
- Mailbox delegates and shared mailboxes.
Where practical, move higher-risk users towards passkeys or FIDO2 security keys. Passkeys use cryptographic credentials protected by a device PIN, fingerprint or face recognition. They are designed to resist fake sign-in pages.
Microsoft explains the approach in its passkey guidance for Microsoft Entra ID.
Harden Microsoft 365
A Microsoft 365 security review should include:
- Blocking legacy authentication.
- Reviewing Conditional Access policies.
- Separating administrator accounts from everyday accounts.
- Applying least-privilege access.
- Monitoring suspicious sign-ins and unfamiliar devices.
- Reviewing mailbox forwarding and inbox rules.
- Checking delegate permissions.
- Restricting risky OAuth application consent.
- Configuring Microsoft Defender for Office 365 where licensed.
- Creating mail-flow rules for external senders and look-alike domains.
- Reviewing audit logs regularly.
This is not a one-time task. Business changes, new applications and staff turnover can all introduce new weaknesses.
Verify payment changes by telephone
Create a written rule:
No new or changed payment destination may be approved from email alone.
Before making a payment or changing bank details:
- Stop the transaction.
- Call the supplier, client or employee using a known number.
- Do not use the number included in the requesting email.
- Confirm the request with someone who did not send the original message.
- Require documented, dual approval for wires, new beneficiaries and payroll changes.
For important transactions, match the invoice against the purchase order, contract, delivery evidence and existing supplier records.
The Australian Cyber Security Centre's BEC guidance provides a useful model for independent verification procedures.
Train staff and test the process
Training should use realistic examples, including:
- Fake invoice changes.
- Executive impersonation.
- Payroll redirection.
- Requests to keep payments confidential.
- Look-alike domains.
- Compromised supplier accounts.
Simulated phishing exercises can help identify where procedures or training need improvement. The aim is not to blame employees. It is to make the correct response clear when someone is under pressure.
A simple "Stop–Call–Confirm–Approve" process is easier to remember than a long security policy.
What to do if a mailbox is compromised
If you suspect that a mailbox has been accessed:
- Contact your IT provider or Microsoft 365 administrator immediately.
- Secure the account and revoke active sessions.
- Reset the password and review MFA methods.
- Check inbox rules, forwarding settings and delegate access.
- Review sign-in logs and audit activity.
- Search for fraudulent messages sent from the account.
- Notify customers, suppliers and colleagues who may have received them.
- Preserve emails, headers, logs and payment records.
- Check for suspicious applications or OAuth permissions.
- Monitor for follow-up impersonation attempts.
Do not simply delete the mailbox or suspicious emails before evidence has been preserved.
What to do if a fraudulent payment was made
Speed matters.
- Contact your bank immediately and request a recall or freeze.
- Explain that the payment resulted from business email compromise.
- Contact the receiving bank if this can be done safely.
- Notify your IT provider and insurer.
- Preserve all emails, payment instructions and call records.
- Report the incident to the appropriate local authorities.
- Consider reporting international fraud to the FBI's Internet Crime Complaint Center.
- Inform affected clients or suppliers promptly and carefully.
Does cyber insurance cover BEC?
Sometimes, but do not assume it does.
Ask your broker or insurer whether the policy covers:
- Fraudulent payment instructions.
- Invoice manipulation.
- Funds-transfer fraud.
- Social engineering.
- Payroll diversion.
- Forensic and legal costs.
- Business interruption.
- Notification and recovery expenses.
Check exclusions, sublimits, deductibles, waiting periods and any requirements for MFA, dual approval, backups or immediate notification.
Cyber insurance is a financial safety net. It is not a replacement for strong controls, staff training and payment verification.
A practical 30-day action plan
BVI businesses can begin with these steps:
- Write and enforce a no-email-only payment rule.
- Enable MFA for all Microsoft 365 accounts.
- Prioritise passkeys or security keys for administrators and finance staff.
- Review mailbox forwarding rules and delegates.
- Configure SPF, DKIM and DMARC.
- Test a supplier bank-detail callback process.
- Train finance, HR and senior staff.
- Run a simulated phishing exercise.
- Review cyber insurance wording.
- Arrange a business technology review to identify remaining gaps.
Fresh Mango BVI can help with Managed IT Services, cyber security services, Microsoft 365 hardening, cyber awareness training and Cyber Baseline certification.
A practical review is a good starting point. It can show where identity, email, payment procedures and incident response need improvement. Before a convincing email turns into a costly business problem.
Frequently asked questions
What is the most effective protection against fake invoice fraud?
Independent verification of payment details using a known telephone number, combined with MFA, dual approval and staff training.
Can DMARC stop business email compromise?
DMARC helps prevent criminals spoofing your domain, but it cannot stop a compromised supplier or client mailbox. It is one part of a wider defence.
Is Microsoft 365 safe from BEC?
Microsoft 365 provides strong security tools, but they must be configured and managed correctly. Businesses remain responsible for identity protection, access controls, monitoring and payment procedures.
Should payroll changes be accepted by email?
No. Verify them through an approved HR or payroll process and call the employee using an existing, trusted number.
Can a small BVI business afford BEC protection?
Most important controls are practical rather than expensive: MFA, payment callbacks, dual approval, staff training and regular reviews. Managed support can also help smaller businesses apply controls consistently.