What Is Business Email Compromise (BEC)?
Business Email Compromise is a social engineering attack where criminals impersonate a trusted party—a vendor, subcontractor, project manager, or executive—to trick someone into wiring money or sharing sensitive data.
Construction is the #1 targeted industry for BEC attacks because of high-value wire transfers, complex vendor relationships, and fast-moving project timelines where people don't always verify payment changes.
How a Typical BEC Attack Works
1. Reconnaissance — The attacker researches your firm, identifies key personnel, and studies active projects through LinkedIn, your website, and public bid databases.
2. Account compromise or spoofing — They either hack a real email account (using stolen credentials) or create a look-alike domain (e.g., optivetech.co instead of optivetech.com).
3. The ask — A convincing email arrives requesting a change to banking details for an upcoming payment, a rush wire transfer for materials, or access to sensitive project documents.
4. Money moves — By the time anyone realizes the request was fraudulent, the funds are in an overseas account and nearly impossible to recover.
Real-World Impact
The FBI's IC3 reported that BEC scams caused over $2.9 billion in losses in 2023 alone. Individual construction firms have lost anywhere from $50,000 to $5 million in a single attack.
How to Protect Your Firm
- Implement email authentication — Configure SPF, DKIM, and DMARC to prevent domain spoofing.
- Require verbal verification — Any payment change request must be confirmed by phone using a known number—never a number provided in the email.
- Use conditional access policies — Restrict email access to managed devices and require MFA on every login.
- Train your AP team — Accounts payable staff are the last line of defense. Regular simulations and training keep them alert.
- Monitor mailbox rules — Attackers often create auto-forwarding rules to silently intercept replies. Audit mailbox rules weekly.
Don't Wait Until You're a Victim
BEC attacks are preventable with the right policies and technology. Schedule a security assessment and let's lock down your email environment before an attacker finds the gaps.