Definition
Business email compromise, or BEC, is a sophisticated cyber attack that targets organizations by impersonating trusted individuals or entities. Attackers use social engineering tactics, often through email, to trick employees into transferring funds, divulging sensitive information, or granting unauthorized access. This threat is particularly dangerous because it exploits human trust rather than technical vulnerabilities, making it difficult to detect with traditional security tools. A common scenario involves an attacker posing as a CEO or vendor, requesting an urgent wire transfer to a fraudulent account. Unlike phishing, which often casts a wide net with generic messages, BEC attacks are highly targeted and personalized, making them more convincing. Understanding BEC is crucial for cybersecurity professionals and is a key topic on certifications like CompTIA Security+ and CySA+.