Business Email Compromise (BEC): Anatomy of Invoice Redirection Wire Fraud

The Anatomy of an Invoice Hijack

Unlike ransomware attacks that announce their presence with locked screens, Business Email Compromise operates silently. Adversaries harvest supplier credentials, lurk quietly in mailbox threads for weeks observing billing cycles, and interject at the moment of payment approval with modified bank routing instructions.

Detecting Lookalike Supplier Domains

When attackers cannot compromise the supplier's actual mailbox, they register typo-squatted domains (e.g., swapping 'rn' for 'm') and spoof the supplier's finance lead. Advanced email security filters must analyze domain age, reputation, and lexical similarity to flag newly registered lookalikes.

Mandatory Out-of-Band Verification Protocols

Technical controls must be reinforced with non-negotiable accounting governance. Any request to modify banking details, IBAN accounts, or currency routing must be verbally confirmed via verified phone numbers on file before transactions are executed.