Glossary
Business email compromise (BEC)
Fraud that uses a real or impersonated business mailbox to redirect payments or steal data, usually after an email account takeover.
Business email compromise (BEC) is fraud carried out through a business mailbox. Usually that mailbox belongs to finance, a buyer or an executive. The attacker takes over the account (or spoofs it), reads the ongoing payment conversations, then sends a convincing "our bank details have changed" message to customers or suppliers.
In Google Workspace the trail typically runs from a risky sign-in, through external forwarding and an email hiding rule, to an outgoing mail about new bank details. The FBI's IC3 reported over $55 billion in exposed BEC losses between October 2013 and December 2023.
See: Gmail forwarding rules set by attackers and the fictional BEC walkthrough.