{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/business-email-compromise","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/business-email-compromise/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/business-email-compromise/"},"term":{"en":"Business email compromise (CEO fraud)","da":"Direktørsvindel (CEO fraud)"},"aka":{"en":["BEC","CEO fraud","invoice fraud"],"da":["CEO fraud","BEC","fakturasvindel"]},"domain":["security"],"cluster":"awareness","layer":"people","status":"current","era":2013,"summary":{"en":"A scam where criminals pose as a boss or supplier by email to trick staff into paying money or sending data.","da":"Svindel, hvor kriminelle udgiver sig for at være chefen eller en leverandør og narrer ansatte til at betale eller sende data."},"body":{"formal":{"en":"A targeted fraud in which the attacker takes over or imitates the email address of a trusted person and sends a believable request, usually to change bank details or make an urgent payment.","da":"En målrettet svindel, hvor angriberen overtager eller efterligner en betroet persons mailadresse og sender en troværdig anmodning - oftest om at ændre bankoplysninger eller foretage en hastebetaling."},"plain":{"en":"Like a forged note that looks exactly as if it came from the boss, telling you to hand the cash box to the person at the door.","da":"Som en falsk seddel, der ser ud til at komme fra chefen, og som beder dig give pengekassen til personen ved døren."},"inPractice":{"en":"A finance clerk in a municipality gets a mail from what looks like a regular supplier's address, saying its bank account has changed; the next three invoices are paid straight to the criminals.","da":"En økonomimedarbejder i en kommune får en mail fra, hvad der ligner en fast leverandørs adresse, om at leverandøren har skiftet bankkonto; de næste tre fakturaer bliver betalt direkte til de kriminelle."},"whyItMatters":{"en":"No harmful software is needed and the mail often looks perfect, so a call to a known number to check is often the only thing that stops a large loss.","da":"Der kræves ingen skadelig software, og mailen ser ofte perfekt ud, så et opkald til et kendt nummer for at tjekke er tit det eneste, der stopper et stort tab."}},"deepDive":{"en":"BEC is a payment-fraud scheme that uses email as its channel, not a malware technique. The FBI's taxonomy distinguishes CEO fraud (an executive orders an urgent transfer), bogus-invoice or supplier schemes, compromise of an employee's own mailbox to bill that employee's customers, attorney impersonation around confidential deals, and data theft such as payroll or tax records as a precursor. In the IC3 2025 annual report BEC was the second-largest cyber-enabled fraud category by loss, with USD 3,046,598,558 reported, behind only investment fraud; the figure covers complaints filed with IC3, so real losses are higher.\n\nTwo technical variants dominate. In the spoofing variant the attacker never gets into any mailbox: a lookalike domain (an extra letter, a different TLD, a homoglyph), a display name that matches the executive over a free-mail address, or a Reply-To header that silently diverts the answer. Sender authentication addresses part of this - SPF (RFC 7208) and DKIM (RFC 6376), aligned under a DMARC policy of p=reject (RFC 7489), stop exact-domain spoofing of your own domain, but do nothing against a lookalike domain that has its own valid DMARC records. In the account-takeover variant, credentials or session tokens are stolen through phishing, often via adversary-in-the-middle kits that defeat OTP and push MFA. The attacker then reads the thread history, waits for a real invoice cycle and creates inbox rules that forward, move or delete replies containing words like invoice or payment (MITRE ATT&CK T1114.003 and T1564.008). Vendor email compromise is the same pattern run from a supplier's mailbox, so the fraudulent message genuinely comes from the trusted domain and passes every authentication check.\n\nBecause the payload is a request, not a file, content filters struggle and the decisive controls are procedural: changes to bank details verified by a call-back to a number already on file (never one given in the message), four-eyes approval above a threshold, cooling-off periods for new payees, and a policy that executives never order payments by email alone. Technical support comes from banner tags on external mail, lookalike-domain monitoring, alerts on new forwarding rules and impossible-travel sign-ins, and phishing-resistant MFA (FIDO2/WebAuthn) to block the takeover path.\n\nRecovery is a race against settlement. Transfers should be recalled through the bank immediately; the FBI's Financial Fraud Kill Chain, run by the IC3 Recovery Asset Team since 2018, reported 3,900 initiated incidents in 2025 with about 58 percent of attempted theft frozen. In Denmark the case is bedrageri under straffeloven § 279 and is reported to the police; if the compromised mailbox held personal data, it may also be a personal data breach notifiable to Datatilsynet within 72 hours under GDPR Art. 33(1).","da":"Direktørsvindel er økonomisk svindel, der bruger mail som kanal, ikke en malwareteknik. FBI's opdeling skelner mellem CEO fraud (en direktør beordrer en hasteoverførsel), falske fakturaer og leverandørsvindel, kompromittering af en medarbejders egen postkasse for at fakturere vedkommendes kunder, efterligning af advokater omkring fortrolige handler samt tyveri af data som løn- og skatteoplysninger som forarbejde. I IC3's årsrapport for 2025 var BEC den næststørste kategori af cyberbaseret svindel målt på tab, med 3.046.598.558 USD indrapporteret, kun overgået af investeringssvindel; tallet dækker de anmeldelser, der er sendt til IC3, så de reelle tab er højere.\n\nTo tekniske varianter dominerer. I spoofing-varianten kommer angriberen aldrig ind i nogen postkasse: Et lookalike-domæne (et ekstra bogstav, et andet topdomæne, et homoglyf-tegn), et visningsnavn, der matcher direktøren, men sidder på en gratis mailadresse, eller en Reply-To-header, der i det stille leder svaret et andet sted hen. Afsendergodkendelse løser en del af det - SPF (RFC 7208) og DKIM (RFC 6376), afstemt under en DMARC-politik med p=reject (RFC 7489), stopper forfalskning af præcis organisationens eget domæne, men gør intet ved et lookalike-domæne med sine egne gyldige DMARC-poster. I kontoovertagelses-varianten stjæles adgangsoplysninger eller sessionstokens via phishing, ofte med adversary-in-the-middle-kits, der omgår engangskoder og push-MFA. Angriberen læser derefter mailtrådene, venter på en rigtig faktureringsrunde og opretter indbakkeregler, der videresender, flytter eller sletter svar med ord som faktura eller betaling (MITRE ATT&CK T1114.003 og T1564.008). Vendor email compromise er samme mønster kørt fra en leverandørs postkasse, så den svigagtige mail reelt kommer fra det betroede domæne og består alle godkendelsestjek.\n\nFordi nyttelasten er en anmodning og ikke en fil, har indholdsfiltre svært ved at fange den, og de afgørende kontroller er procesmæssige: Ændring af bankoplysninger verificeres ved at ringe tilbage på et nummer, man allerede har registreret (aldrig et nummer fra mailen), to personers godkendelse over en beløbsgrænse, karensperiode for nye betalingsmodtagere og en regel om, at ledelsen aldrig beordrer betalinger via mail alene. Den tekniske støtte er bannere på eksterne mails, overvågning af lookalike-domæner, alarmer på nye videresendelsesregler og logins fra umulige placeringer samt phishing-resistent MFA (FIDO2/WebAuthn), der lukker vejen til kontoovertagelse.\n\nGenopretning er et kapløb med afviklingen af betalingen. Overførsler skal straks kaldes tilbage via banken; FBI's Financial Fraud Kill Chain, som IC3's Recovery Asset Team har drevet siden 2018, rapporterede 3.900 igangsatte sager i 2025, hvor omkring 58 procent af de forsøgte beløb blev indefrosset. I Danmark er sagen bedrageri efter straffelovens § 279 og anmeldes til politiet; indeholdt den kompromitterede postkasse personoplysninger, kan det også være et brud på persondatasikkerheden, der skal anmeldes til Datatilsynet inden for 72 timer efter databeskyttelsesforordningens art. 33, stk. 1."},"edges":[{"type":"requires","to":"cs/account","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/spear-phishing","confidence":"high","strength":"normal"},{"type":"exploits","to":"security/vulnerability","why":{"en":"It abuses staff's trust in their leaders and their wish to act quickly on urgent orders.","da":"Den udnytter medarbejdernes tillid til ledelsen og ønsket om at handle hurtigt på hasteordrer."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"security/pretexting","confidence":"high","strength":"normal"},{"type":"used-with","to":"ai/deepfake","confidence":"high","strength":"normal"}],"depth":1,"sources":[{"title":"FBI IC3 - Business Email Compromise","url":"https://www.ic3.gov/","tier":"official-doc","publisher":"FBI"},{"title":"Cyber Security Fast Track - Kursuskompendium, Modul 2","tier":"course-material"},{"title":"FBI IC3 - 2025 Internet Crime Report","url":"https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf","tier":"official-doc","publisher":"FBI"}],"draft":true}