Business email compromise is fraud by email. A criminal either takes over a real mailbox or convincingly fakes one, then uses it to redirect a payment or extract information. It is one of the most financially damaging attacks Canadian small businesses face, and it rarely involves anything your antivirus would flag.
How Does a Business Email Compromise Attack Work?
Most BEC cases we see follow the same pattern:
- Access. The attacker phishes a password from someone in finance, a supplier or an executive. Often the login page is a perfect copy of the Microsoft 365 sign-in screen.
- Reconnaissance. They read the mailbox quietly for days or weeks. They learn who pays whom, when invoices go out and how people write.
- Persistence. They create inbox rules that hide replies, forward copies of mail elsewhere, or register their own MFA method.
- The ask. At the right moment, they send a believable message: "Our bank has changed, please use the attached details for this month's invoice."
A Calgary construction firm gets an invoice from its regular concrete supplier, sent from the supplier's real address, referencing a real job. The only change is the bank account. That is what makes BEC hard. Nothing looks wrong.
What Are the Common Types of BEC?
| Type | What it looks like |
|---|---|
| Vendor invoice fraud | A real or lookalike supplier sends new banking details |
| CEO fraud | A message "from the owner" asks for an urgent wire or gift cards |
| Payroll diversion | An "employee" asks HR to change their direct deposit account |
| Real estate and legal trust fraud | Closing funds redirected days before a transaction |
| Data theft | Requests for T4s, client lists or tax records |
Lookalike domains are common too. A "supplier" in Mississauga might write from an address with one letter changed, which is called typosquatting.
Why Doesn't Antivirus or a Spam Filter Stop It?
Because there is usually no attachment to scan and no malicious link at the moment of the fraud. The email comes from a legitimate account, or a freshly registered domain with no bad reputation. Filters are getting better at spotting impersonation, but the decisive control is a human process.
How Do You Prevent Business Email Compromise?
The controls that matter, roughly in order of impact:
- Verify every banking change by phone, using a number you already have on file, never one from the email. Make this a written policy with no exceptions for urgency or seniority.
- Use phishing-resistant MFAon Microsoft 365 or Google Workspace. Basic MFA helps, but attackers now use adversary-in-the-middle kits that steal session tokens. See our article on whether SMS MFA is good enough.
- Publish SPF, DKIM and DMARCfor your domain so criminals cannot easily send mail as you. A DMARC policy of quarantine or reject is the goal.
- Monitor for suspicious inbox rules and sign-insNew forwarding rules, logins from unusual countries and new MFA registrations are classic signs of compromise.
- Train finance and admin staff specificallyGeneral awareness training is fine. A 20-minute session for the people who actually release payments is better.
What Should You Do If You Think You've Been Hit?
Call your bank immediately and ask for a recall of the transfer. Speed matters more than anything else here, since funds are moved on quickly. Then reset the affected account, revoke active sessions, check for inbox rules and new MFA methods, and report to the Canadian Anti-Fraud Centre and local police. If personal information was exposed, you may also have breach reporting obligations, covered in Do I have to report a data breach in Canada?.
Is BEC Covered by Cyber Insurance?
Sometimes. Many policies treat social engineering or funds transfer fraud as a separate coverage with a lower sublimit, and some require that you followed a call-back verification procedure. Read that section of your policy before you need it. Our Microsoft 365 and email security service focuses on the account-level controls that stop BEC before the payment request ever arrives.