Module 2 · Email Security
Spotting a business email compromise
4 min episode
Business email compromise (BEC) attacks skip the malware and go straight for your trust. This episode shows the three signals that give a BEC email away, and the one habit that stops it.
Episode preview
Key takeaways
- BEC relies on urgency and authority, not malicious attachments.
- A mismatched or look-alike sender domain is the clearest tell.
- Verify any change to payment details through a second, known channel.
Episode transcript
What business email compromise looks like
A BEC email impersonates someone you trust, such as an executive, a supplier, or a colleague in finance, and asks you to do something routine but consequential: pay an invoice, change bank details, or buy gift cards.
There is usually no attachment and no obvious link. That is the point. The attacker is exploiting your working relationship, so traditional "don’t click the link" advice does not fire.
The three signals
First, urgency: the request is time-sensitive and discourages you from checking. Second, authority: it appears to come from someone senior enough that you would not want to push back. Third, a quiet change of details: a new account number, a slightly different domain, a reply-to that does not match.
Any one of these deserves a second look. Two or more together is a strong signal to stop and verify.
The habit that stops it
Verify out of band. Before acting on a payment or a change to financial details, confirm through a channel you already trust, such as a phone number you have on file, an in-person check, or a message in your internal chat. Never verify using the contact details in the suspicious email itself.
Check your understanding
The same quick check learners get after the episode. Pick an answer to see how it works.
An email from your CFO asks you to urgently update a supplier’s bank details before a payment run in an hour. What is the safest next step?
Which of these is the clearest technical tell of a BEC email?
This is one episode of the full curriculum
The rest is built the same way: short, focused episodes you complete at your own pace, on any device.