Business email compromise: How AI changes BEC attacks and how to prevent them

Business email compromise: How AI-personalized attacks target specific people

BEC often needs no malware, no exploit, and no suspicious attachment. In impersonation attacks, the attacker needs a lookalike domain or spoofed address and someone willing to act on the message. In account takeover, the attacker gets into a real mailbox, sometimes through info-stealer malware or phishing kits that capture login sessions, and writes from a trusted account. AI makes both cheaper to build and easy to repeat across hundreds of targets at once.

What is business email compromise?

In a BEC scam, the attacker poses as someone the target trusts: an executive, a vendor, a coworker. The aim is money, credentials, or data. Some attacks use spoofed or lookalike domains. Others use email account compromise, where the attacker logs into a real mailbox and writes from it. That version is harder to catch. The message comes from the genuine address, often inside an existing thread.

Common BEC attack examples

Four patterns show up again and again.

• Vendor invoice fraud: An attacker with access to a supplier's mailbox replies to a real invoice thread with updated bank details. Accounts payable sees a familiar sender in a familiar conversation, and the payment goes to the attacker.
• Executive impersonation: A message that appears to come from the CEO asks a finance employee for an urgent wire transfer and discourages follow-up calls.
• Payroll diversion: Someone posing as an employee asks HR to change direct deposit details.
• Thread hijacking: With a compromised account, the attacker reads ongoing conversations and waits for the right moment to step in.

How AI changes BEC fraud

Traditional BEC ran on manual effort. Attackers researched a company, identified who approves payments, and wrote each message by hand. That kept the volume low and limited how many targets one attacker could work. AI changes the economics at each stage.

Many executives, no breaks

Executive-targeted BEC used to be manual. An attacker picked one executive, or a couple, and kept trying until the target replied or the attacker quit. Every attempt cost time, so target lists stayed short.

With AI, an attacker can build a list of hundreds of C-level and senior finance contacts, generate a distinct message for each, and keep sending around the clock. Ignore one and you get a follow-up built on a different pretext. Automation tracks who replied, who didn't, and what to try next. Executives usually hold broad access, so one success can reach payment approvals, board materials, and sensitive data.

Research at organization scale

Company websites, press releases, job postings, and professional networking profiles reveal names, titles, reporting lines, and vendor relationships. Automated tools collect that for an entire company in minutes. If the attacker already controls one mailbox, the inbox adds real project names, invoice numbers, and the way colleagues actually talk to each other.

Writing that matches the sender

A language model can read a few dozen emails from a compromised account and reproduce the sender's greeting, sign-off, and sentence length. The output is clean, fluent text in whatever language the target reads. Spelling mistakes and awkward phrasing used to be the standard warning signs. They're disappearing.

Timing from inside the thread

A model can summarize a long thread and spot the moment that matters: an approved invoice, a pending wire, a contract renewal. The attacker's message then lands while a payment conversation is already underway, which is when new bank details look routine.

Faster credential attacks

Account takeover is what makes thread hijacking possible, and AI speeds that up too. Names, pets, birthdays, and employers scraped from public profiles feed guess generators that produce likely passwords for a specific person. Breached credentials get tested against many accounts in sequence, and automation handles the retries.

Side by side:

Email account compromise starts with credentials

Lookalike domains can be blocked or flagged. A taken-over real account is harder to detect because the sender is legitimate. Most takeovers start with a credential: a password reused from a breached site, a passphrase built from personal details, or a shared login saved in a spreadsheet that dozens of people can open.

Executives face higher stakes because attackers keep at it. A weak or reused password may survive a handful of attempts. Thousands is another matter.

Once inside, attackers read mail, search for words like "invoice," "wire," and "payment," and set rules that hide their activity. A forwarding rule, or a rule that moves replies to an obscure folder, can keep the real owner unaware for weeks.

BEC prevention: Strengthen the password layer

Email filtering and user training matter. Two controls on the credential layer lower the odds that a stolen or reused password becomes a compromised mailbox.

Netwrix Password Policy Enforcer goes well past native Active Directory complexity rules. It checks new passwords against breached lists such as Have I Been Pwned, blocks dictionary words and predictable patterns, and applies different policies to different users, groups, and OUs. Real-time feedback explains why a password was rejected, so people can pick a stronger one on the spot. Because policies can be assigned by group, executives and finance teams can get a stricter policy than everyone else.

Netwrix Password Secure covers credentials that central/AD-policies don't reach: shared mailbox logins, vendor portals, privileged accounts. It stores them in an encrypted vault, grants access by role, and supports approval workflows for sensitive accounts. Every access is logged, and MFA adds another check at the vault itself. Credentials come out of spreadsheets and chat threads, and you get a record of who used what, and when.

Data classification shows which mailboxes and repositories hold the most sensitive content, so you know what a single compromised account could reach.

Business email compromise prevention checklist

1. Enforce a password policy that blocks breached, dictionary, and predictable passwords, with a stricter version for executives and finance teams.
2. Move shared and privileged logins out of spreadsheets and into a vault with role-based access.
3. Require phishing-resistant MFA on email, finance systems, and the vault.
4. Verify any change to bank details or payment instructions through a separate channel, such as a call to a known number.
5. Audit forwarding and inbox rules, and review sign-in activity for finance, HR, and executive mailboxes.
6. Tell people that AI-written messages read cleanly. Typos are no longer the main warning sign.