Spear Phishing and Business Email Compromise

From Mass Phishing to Targeted Attacks

Most people understand generic phishing — mass-sent emails claiming to be Netflix or UPS, hoping a small percentage of recipients bite. Spear phishing is an entirely different threat: it's targeted, personalized, and dramatically more effective.

Instead of casting a wide net, a spear phisher researches a specific victim or organization and crafts an email that appears to come from a trusted source — a colleague, a vendor, or a senior executive — referencing real context that makes the email believable. Success rates for spear phishing are 3 to 10 times higher than generic campaigns.

Business Email Compromise (BEC) is a specific and financially devastating form of spear phishing targeting organizations. The FBI's Internet Crime Complaint Center (IC3) consistently ranks BEC as one of the most costly cybercrime categories, with billions in annual losses. BEC attacks don't need malware or technical exploits — they exploit human trust and business processes.

How Attackers Research Targets

A sophisticated attacker spends significant time on reconnaissance before sending a single email. Sources include:

Open Source Intelligence (OSINT)

• LinkedIn: Reveals organizational structure, reporting relationships, job titles, technologies in use (job listings mention tech stacks), and employee names
• Company websites: Identifies executives, department heads, contact addresses, and company email format (firstname.lastname@company.com)
• Social media: Personal details, recent events, conferences attended, projects mentioned — context that makes emails credible
• Press releases and financial filings: Reveals mergers, acquisitions, key vendors, and upcoming deals
• Domain WHOIS records: Contact information, registrar details
• Data breach databases: Compromised credentials for employees, which may still be valid or reveal password patterns

Email Address Harvesting

Once the company's email format is known, attackers can generate addresses for any employee. Tools like Hunter.io aggregate publicly visible email addresses from across the web, making this trivially easy.

Common BEC Attack Scenarios

CEO Fraud

The attacker impersonates the CEO (or another senior executive) and emails the finance team requesting an urgent wire transfer. The email creates pressure:

"I'm in a board meeting and can't talk. I need you to wire $47,000 to this account by 3pm for a confidential acquisition. Don't discuss with anyone until this closes."

The urgency, authority, request for secrecy, and a plausible business context combine to bypass normal verification instincts.

Vendor Invoice Fraud

The attacker compromises or impersonates a legitimate vendor and sends modified invoices with changed payment account details. The company pays a real invoice — but to the attacker's account.

This attack often follows actual monitoring of a compromised email account to understand the business relationship and timing of real invoices.

Payroll Diversion

Attackers impersonate employees and email HR or payroll requesting a change to their direct deposit account. Next payroll cycle, the employee's salary goes to the attacker.

Account Takeover

Rather than spoofing an email, the attacker uses stolen credentials to take over a real email account — giving them perfect impersonation, access to email history for context, and the ability to intercept and modify real communications.

Why These Attacks Succeed

• Authority bias: Requests from executives are processed differently — people hesitate to question or verify
• Urgency and time pressure: Urgent requests short-circuit careful thinking
• Familiarity: Emails reference real colleagues, projects, and vendors, passing the gut-check
• Organizational silos: Finance may not have direct access to verify with the CEO in time
• Bypassing technical controls: BEC uses legitimate email, social engineering, and no malware — most technical defenses are blind to it

Technical Defenses for Organizations

Email Authentication Protocols

• SPF (Sender Policy Framework): Specifies which mail servers are authorized to send email for a domain. Prevents some spoofing.
• DKIM (DomainKeys Identified Mail): Adds a cryptographic signature to outgoing email, proving it wasn't tampered with in transit.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance): Instructs receiving mail servers what to do with emails that fail SPF or DKIM checks — reject, quarantine, or monitor. A DMARC policy set to reject prevents direct domain spoofing.

These three protocols, properly configured, prevent attackers from spoofing your exact domain — but they don't prevent lookalike domains (e.g., company-inc.com vs. companyinc.com).

Multi-Person Approval for Transfers

Require dual authorization for wire transfers above a threshold. No single employee should be able to initiate a significant transfer based on an email alone.

Out-of-Band Verification

Establish a policy: for any payment direction changes or unusual transfer requests, verify by calling the requestor on a known, pre-established phone number — never a number provided in the suspicious email.

Security Awareness Training

Regular, realistic phishing simulations train employees to recognize and report suspicious emails. Training should cover BEC scenarios specifically, not just generic phishing.

What to Do If You Suspect a BEC Attack

1. Do not complete the requested action — pause even if there's pressure to act fast
2. Verify through a separate channel: Call the requestor directly using a number from your contacts, not the email
3. Report to your security team or IT department immediately
4. If a transfer was made: Contact your bank immediately — wire transfers can sometimes be reversed within hours through the bank's fraud prevention process
5. Preserve all evidence: Do not delete or modify the suspicious email