Glossary
BEC (Business Email Compromise)
A type of fraud where an attacker compromises or impersonates a legitimate mailbox to validate a fraudulent transfer or bank-account change.
BEC has become the costliest fraud vector for French SMBs per unit, ahead of ransomware. Typical scenario: an attacker compromises an executive's or accountant's mailbox (via phishing or stolen password), then waits for the right moment to send a fake transfer order or bank-account change from that legitimate mailbox.
Average amounts are substantial: €30,000 to €500,000 per incident, sometimes more. For an SMB, a single successful BEC can represent months of cash flow.
Three defences: (1) 2FA on all business mailboxes — neutralises a stolen password, (2) DMARC in reject mode — prevents attackers from sending "from" your domain without controlling it, (3) an out-of-band validation process for any bank-account change or transfer above a defined threshold — a phone call to the usual number suffices. This process is in module 7 of Essentials.