Here's an uncomfortable truth: the most expensive cyberattack hitting businesses right now doesn't involve malware, doesn't trip your firewall, and doesn't encrypt a single file. It's an email. A well-written, well-timed, completely clean email asking your bookkeeper to update a vendor's banking details.
Business email compromise (BEC) has quietly become one of the costliest crimes in America — the FBI's Internet Crime Complaint Center tallies billions in reported losses every year, and the Verizon Data Breach Investigations Report consistently ranks pretexting and BEC among the top financially motivated attack patterns. For the small and mid-sized businesses we work with across Ohio, Michigan, and Indiana, a single successful BEC attack routinely costs more than a year of comprehensive cybersecurity.
This guide covers what business email compromise actually is, why your existing defenses can't see it, and the layered protection — across Microsoft 365, MFA, email authentication, and plain old human verification — that actually stops it.
What Is Business Email Compromise?
Business email compromise is fraud that uses email as the con, not the weapon. Instead of breaking into your network, attackers impersonate — or outright take over — a trusted email identity and use it to redirect money or steal sensitive data.
The classic versions look like this: your "CEO" emails accounting from the road asking for an urgent wire transfer. A long-time "vendor" sends a real-looking invoice with updated banking details. An "employee" emails HR asking to change their direct deposit account. In every case, the request rides on trust that already exists inside your business.
That's what makes BEC an identity and workflow problem, not a network problem. There's no virus to detect, no suspicious attachment, no malicious link. The payload is a sentence: "Can you process this today?" And the vulnerability isn't a server — it's the fact that your payment process trusts whatever shows up in an inbox.
How BEC Attacks Actually Work
Most BEC attacks follow a patient, three-act structure.
Act one: get in or get close. The attacker either phishes an employee's Microsoft 365 password (often through a fake login page) or registers a lookalike domain — think "flyghtsupport.com" versus "flyght.support" — that passes a quick glance. Compromised credentials are the gold standard because they let the attacker send from a genuinely legitimate mailbox.
Act two: watch and learn. Inside a compromised mailbox, attackers read. They study who approves payments, which vendors invoice on what schedule, how your controller phrases things, and when your CEO travels. Many set up hidden inbox rules that auto-forward financial threads to an outside address and delete the evidence — so the mailbox owner never notices a thing.
Act three: strike at the seam. When a real invoice is due or the boss is genuinely out of town, the attacker inserts the fraudulent request — right thread, right tone, right timing. The bookkeeper isn't being careless when they pay it. They're doing their job exactly the way they always have. That's the entire trick.
Why Your Firewall (and Spam Filter) Can't Catch It
Firewalls inspect network traffic. Spam filters look for malware signatures, malicious links, and known-bad senders. BEC emails have none of those things.
A fraudulent payment request sent from a genuinely compromised vendor mailbox is, technically speaking, a perfectly legitimate email. Real server, real domain, real sending history, real conversation thread, no attachment, no link. Every traditional security tool waves it through — because by every technical measure, it's clean.
This is the core mistake we see in a lot of security setups across northwest Ohio: businesses invest in perimeter defenses built for malware and assume email fraud is covered. It isn't. Stopping BEC requires controls that address identity (who is actually logged into that account?), authenticity (did this email really come from that domain?), and process (does a single email have the power to move money?). No firewall answers any of those questions.
Advanced email security is the front line against BEC
Flyght's managed email security layers impersonation detection, link and attachment analysis, and account takeover monitoring on top of Microsoft 365 — the protections built specifically for the attacks filters miss.
The Layered Defense That Actually Stops BEC
No single tool stops business email compromise. What works is a stack of controls where each layer catches what the previous one misses. Here's the layered defense we build for clients across the tri-state region.
Layer 1: Lock down identity in Microsoft 365
Since most BEC starts with a stolen password, identity is the first fight. Enforce multi-factor authentication on every account — no executive exceptions, since executives are the primary targets. Better yet, use phishing-resistant methods (authenticator apps with number matching, or hardware keys) instead of SMS codes.
Then go further with conditional access: block legacy authentication protocols that bypass MFA entirely, restrict sign-ins from countries you don't do business with, and require compliant devices for mailbox access. Microsoft 365 has these controls built in — most businesses just never turn them on.
Layer 2: Authenticate your email with DMARC, DKIM, and SPF
SPF, DKIM, and DMARC are DNS records that prove email claiming to be from your domain actually is. SPF lists which servers may send as you. DKIM cryptographically signs your outbound mail. DMARC tells receiving servers what to do when a message fails both checks — and, critically, sends you reports on who's spoofing your domain.
Most SMBs either haven't published these records or run DMARC in "monitor only" mode forever, which blocks nothing. Getting DMARC to an enforcement policy (quarantine or reject) shuts down attackers spoofing your exact domain — protecting your vendors and customers from fraudsters wearing your name.
Layer 3: Add email security built for impersonation
Advanced email security goes beyond spam filtering to analyze behavior: Is this "CEO" email actually from a lookalike domain registered last Tuesday? Does this vendor's writing style suddenly look different? Is this the first time this sender has ever asked about banking details? These tools flag executive impersonation, newly registered domains, and anomalous requests that content filters can't see — and they monitor for the inbox-rule shenanigans that signal an account takeover already in progress.
Layer 4: Build verification into your payment workflows
Technology narrows the attack surface; process closes it. Institute one unbreakable rule: any request to change banking details, initiate a wire, or reroute payroll gets verified out-of-band — a phone call to a number you already have on file, never a number from the email itself.
Add dual approval for payments above a threshold you're comfortable with. Yes, it adds a step. That step is the difference between a mildly annoyed vendor and a six-figure loss that your bank, in most cases, will not reimburse. Pair the workflow with regular security awareness training and phishing simulations so your team recognizes the pressure tactics — urgency, secrecy, authority — that every BEC email leans on.
What Should Be Monitored 24/7
BEC is a race: the attacker needs days inside a mailbox to study your business, and a SOC that spots the intrusion on day one wins. The signals worth watching around the clock in Microsoft 365 are specific and well-known: sign-ins from impossible locations or unfamiliar devices, new inbox rules that forward or delete mail, changes to MFA methods or recovery details, suspicious OAuth application grants, and unusual outbound email volume.
The catch is that these logs don't watch themselves. Alerts at 2 a.m. on a Saturday only matter if someone acts on them — locking the account, killing sessions, and removing malicious rules before the attacker sends a single fraudulent email. That 24/7 detection-and-response layer is exactly what managed cybersecurity provides, and it's the difference between a contained incident and a wire that's already gone.
What Leadership Should See Every Month
If email security only lives in the IT department, leadership finds out about BEC exposure the day money leaves the account. The fix is a short monthly report with numbers that actually mean something: MFA coverage across all accounts (the only acceptable number is 100%), DMARC enforcement status, impersonation and phishing attempts blocked, training completion and phishing-simulation click rates, and any account compromise events with time-to-containment.
These metrics do double duty. They give owners real visibility into a real financial risk, and they're precisely the evidence cyber insurance carriers now demand — many policies require documented MFA and email authentication before they'll cover social engineering losses at all. If your current IT provider can't produce this report, that's a conversation worth having.
The Bottom Line: BEC Is a Trust Problem, and Trust Needs Layers
Business email compromise succeeds because it targets the one thing every business runs on: trust between people who move money. No firewall inspects trust. Protection means layering identity controls in Microsoft 365, email authentication with DMARC, DKIM, and SPF, impersonation-aware email security, human verification workflows, and 24/7 monitoring — so that when one layer misses, the next one catches.
None of this requires an enterprise budget. It requires someone who's dialed in on the details: the conditional access policies, the DMARC enforcement, the inbox-rule alerts, the payment verification procedures. That's the work.
Find Out If a Fake Invoice Would Fool Your Business
Most businesses don't know their BEC exposure until money is already gone. Flyght offers a no-BS email security assessment for businesses across Ohio, Michigan, and Indiana — we'll check your MFA coverage, your DMARC status, your Microsoft 365 configuration, and your payment verification workflows, and tell you honestly where the gaps are.
One number to call: (419) 670-7100. Or fill out the contact form and we'll reach out. Either way, you'll know where you stand before an attacker does.