Expert Opinion: 5 common types of business email compromise attacks

Dave Taylor from Stockport IT and business support business, Amshire, explains the five most common ways cyber attacks are likely to attempt to compromise your business email.

These are among the most common types of successful Business Email Compromise (BEC) attacks.

CEO Fraud

The attacker impersonates a high-ranking executive (like a CEO or CFO) to pressure employees into transferring money or sensitive data. Often, they send urgent emails requesting payments or confidential information.

Vendor Invoice Scam

The attacker poses as a trusted vendor and sends fraudulent invoices or payment requests to the company. They may claim a change in bank details or request immediate payment due to an “overdue” status.

Account Takeover

The attacker gains access to an employee’s email account and uses it to request sensitive information or unauthorised payments from internal or external contacts.

Payroll Diversion

The attacker impersonates an employee and requests changes to payroll details, redirecting payments to the attacker’s bank account.

Data Theft

The attacker targets HR or finance departments to steal personally identifiable information (PII) or sensitive employee data that can be used for further attacks.