Fraudsters have evolved their tactics from generic scams to highly targeted attacks exploiting trust and insider knowledge. Business email compromise (BEC) and phishing attacks are among the most effective strategies attackers deploy against accounts payable (AP) teams, capitalizing on their access to sensitive financial information and critical payment processes. Understanding the key differences between BEC and phishing is essential for identifying and responding to these increasingly sophisticated threats.
Key takeaways
- Phishing attacks use fake emails, malicious links, or harmful attachments to steal sensitive information or install malware on a victim’s system.
- BEC is a sophisticated form of phishing that targets specific individuals at an organization, such as executives or finance personnel, by impersonating trusted contacts.
- Organizations can combat BEC and phishing through measures such as dual-factor authentication, employee training, automation, and the use of secure payment methods like virtual cards.
An overview of phishing
Phishing is a particularly pressing issue for AP teams. According to MineralTree’s 9th Annual State of AP Report, 96% of buyers cited phishing as one of the most common types of fraud related to AP in their organizations. This high prevalence underscores the need for robust security training and proactive measures to protect against phishing attempts.
Phishing is a particularly pressing issue for AP teams. According to MineralTree’s 9th Annual State of AP Report, 96% of buyers cited phishing as one of the most common types of fraud related to AP in their organizations. This high prevalence underscores the need for robust security training and proactive measures to protect against phishing attempts.
An overview of business email compromise
BEC is a targeted form of phishing in which fraudsters impersonate trusted individuals to exploit an organization. In these attacks, fraudsters pose as CEOs, vendors, or even legal representatives to manipulate financial transactions and deceive employees into making unauthorized payments.
The State of AP Report reveals that 42% of respondents experienced increased BEC incidents over the past 12 months, while 47% reported a steady number of incidents. The use of insider knowledge makes BEC particularly dangerous because it allows attackers to craft highly targeted and sophisticated scams.
Companies with 50,000 or more employees have a 100% likelihood of encountering a BEC threat every week. Even companies with fewer than 1,000 employees have a 70% chance of facing such threats weekly.
What are the key differences between BEC and phishing?
While BEC and phishing may seem similar at first glance, they differ in several key ways, including:
- Targeting
- Scale
- Sophistication
- Goals
Targeting
BEC attacks are highly focused and often target specific individuals within an organization, such as executives or finance team members. Attackers typically conduct extensive research on the target company’s structure and roles to make their impersonation attempts more convincing.
In contrast, traditional phishing is broader in scope. Attackers cast a wide net to trick as many individuals as possible without targeting specific roles. Phishing also includes various types of scams, such as smishing (SMS phishing) and vishing (phishing conducted over the phone).
Scale
Compared to phishing attempts, BEC attacks operate on a smaller scale, usually targeting one or a few key individuals within an organization. This focused approach makes BEC harder to detect.
On the other hand, phishing targets a much larger audience. Attackers may send thousands of generic emails to individuals, relying on the sheer volume of attempts to trick even a small fraction of recipients.
Sophistication
BEC scams are highly sophisticated and tailored to their targets. Before carrying out a BEC scam, fraudsters invest considerable time in understanding company hierarchies, payment processes, and even interpersonal relationships to craft more convincing messages.
Conversely, phishing emails tend to be generic and lack personalization. They often contain spelling errors or inconsistencies, which makes them easier to spot compared to more advanced BEC tactics.
Goals
The primary goal of BEC attacks is financial gain. Fraudsters aim to manipulate wire transfers, payroll processes, or vendor payments to steal large sums of money.
While phishing attempts can be financially motivated, they often focus on stealing personal data like usernames, passwords, or identity information. Fraudsters can sell stolen data on the black market or use it for other fraudulent activities, making phishing a versatile tool for cybercriminals.
| Business email compromise | Phishing | |
| Targeting | Most targeted | Less targeted |
| Scale | Smaller scale | Larger scale |
| Sophistication | Highly personalized | Often generic |
| Goals | Financial gain | Personal data/identity gain, sometimes financial gain |
Examples of BEC and phishing
Reviewing real-world examples helps clarify the distinct tactics used in BEC and phishing attacks. Here are some of the most prevalent types of fraud facing businesses today:
BEC examples
Examples of BEC emails include the following:
- CEO fraud
- Vendor fraud
Let’s take a deeper look into the different types of fraud below.
- CEO fraud: Attackers using CEO fraud impersonate a senior executive and instruct an employee, such as a finance team member, to transfer funds. Fraudsters use urgent language to pressure employees into bypassing typical verification procedures.
- Vendor fraud: With vendor fraud, bad actors pose as trusted vendors and request changes to payment details—a particularly effective tactic when targeting long-standing vendor relationships. Attackers may create fake invoices or modify legitimate ones to redirect payments to fraudulent accounts.
- Legal impersonation: Attackers claim to be lawyers or legal representatives, using legal jargon and threats of severe consequences to manipulate employees into transferring funds.
- Email spoofing: Fraudsters slightly alter a legitimate email address to make their message appear authentic, which they use to deceive employees.
- Account fraud: Attackers impersonate a known contact to trick employees into providing account credentials. For example, an attacker may impersonate an IT team member, requesting login details to solve an urgent issue. Once they gain access, attackers can use employee credentials to infiltrate the company’s broader network and steal sensitive data.
Phishing examples
Examples of phishing include the following:
- Email phishing
- Spear phishing
- Whaling
- Smishing
- Vishing
Keep reading for more information on each of these instances of fraud.
- Email phishing: This is the most common form of phishing in which attackers send fraudulent emails to a broad audience, aiming to deceive recipients into clicking malicious links or downloading harmful attachments.
- Spear phishing: Attackers gather personal details about their victims to craft tailored, realistic messages. By targeting a particular individual or group, attackers are more likely to succeed in deceiving recipients into revealing sensitive data.
- Whaling: These attacks target senior executives, often referred to as ”whales.” In a whaling phishing attack, fraudsters attempt to manipulate executives into authorizing large financial transactions or sharing confidential company information through authoritative, carefully crafted messages.
- Smishing: Attackers exploit the immediacy of mobile communication by sending urgent text messages designed to trick recipients into clicking malicious links or providing personal data.
- Vishing: Voice phishing uses phone calls to extract sensitive information from victims. Attackers typically impersonate trusted institutions, like banks, to persuade victims to share personal or financial details over the phone.
Preventing fraud
Fraud prevention remains a major challenge for AP teams. Consider implementing the following measures to bolster your defenses against BEC and phishing threats:
- Staff training
- Segregation of duties
- Dual-factor authentication
- Strong internal controls
- Digitized payment methods
- Positive Pay
- Automation
Staff training
Employee education is one of the most effective defenses against fraud. Regular, interactive training sessions can teach staff how to spot phishing attempts and BEC scams. It’s also important to provide updates on evolving phishing tactics and discuss protocols for verifying suspicious requests. To measure the impact of training sessions and identify gaps in employee awareness, you can conduct exercises like phishing simulations that mimic real-world scenarios.
Segregation of duties
Segregating duties ensures that no single person is responsible for all parts of a financial transaction. This division of responsibilities creates multiple checkpoints that both make it harder for fraudulent activity to go unnoticed and enhance accountability because employees are responsible for only specific parts of the transaction process.
Dual-factor authentication
Implement dual-factor authentication to add an extra layer of security—even if credentials are compromised. This extra layer requires users to verify their identity through something they have (e.g., a mobile device) or something they are (e.g., biometrics), which makes it extremely difficult for attackers to gain access.
Strong internal controls
Robust internal controls play a key role in reducing fraud risk. For instance, setting transaction limits and requiring multiple approvals for high-value transactions helps prevent unauthorized transactions. Maintaining a clear audit trail for financial activities also provides greater visibility and helps detect suspicious behavior.
Digitized payment methods
Traditional paper checks are highly susceptible to fraud. Consider switching to digital payments like ACH transfers and virtual cards, which are inherently more secure, traceable, and less prone to tampering. Digital payments also provide real-time verification and reduce the manual handling of sensitive financial information.
Positive Pay
If you can’t avoid checks entirely, consider using Positive Pay—a fraud prevention tool that matches issued checks with checks presented for payment. Positive Pay ensures authenticity by detecting unauthorized or altered checks before they are cashed.
Automation
AP automation software offers another powerful defense against fraud. By automating workflows like invoice approvals and payment processing, you can reduce manual processes and establish consistent, secure procedures that leave little room for fraud and error. Additionally, automated reconciliation can help swiftly identify discrepancies in payment data that you may otherwise overlook.
Final thoughts
As fraudsters grow increasingly sophisticated with their BEC and phishing attacks, combating these tactics through secure and automated payment processes becomes essential. MineralTree’s secure, end-to-end AP automation solution leverages dual-factor authentication to help identify and prevent suspicious activities before they cause harm.
With MineralTree, you can use digital payment methods like virtual cards and ACH transfers to reduce fraud risk further. Positive Pay integration and seamless segregation of duties can also ensure an additional layer of protection against unauthorized transactions.
Schedule a demo to learn how MineralTree safeguards your finances while streamlining operations.
FAQs on business email compromise and phishing
Tl;dr? If you’re short on time, the frequently asked questions below provide a quick snapshot of what you need to know about business email compromise and phishing.
1. How common is business email compromise?
Business email compromise (BEC) is very common. Larger organizations with at least 50,000 employees have a 100% chance of experiencing a BEC threat weekly. Smaller businesses are still highly susceptible because attackers target organizations of all sizes.
2. What is the difference between BEC and EAC?
BEC (business email compromise) involves attackers impersonating trusted business contacts or employees to trick organizations into authorizing fraudulent transactions. On the other hand, EAC (email account compromise) occurs when an attacker gains unauthorized access to a legitimate email account, using it to manipulate employees into making fraudulent payments or to steal sensitive information.
3. What is the most difficult phishing to detect?
Spear phishing and whaling are among the most challenging types of phishing to detect because they are highly personalized and target specific individuals with detailed information about their company or role. Attackers often mimic genuine communication patterns, which makes it difficult for even well-trained employees to recognize them.
4. What is the strongest indicator of a phishing email?
The strongest indicator of a phishing email is urgency combined with requests for sensitive information. Legitimate employees and leaders will never immediately pressure you into providing sensitive data or credentials. Other common indicators of phishing emails include spelling errors and unfamiliar sending addresses.
