Business Email Compromise (BEC) Prevention: The 2026 Indian Enterprise Playbook

How BEC Actually Works in 2026

Business Email Compromise is no longer crude. Modern BEC is reconnaissance-heavy, targeted, and exploits human trust at moments of legitimate transaction. A successful 2026 BEC attack typically involves 4-8 weeks of preparation before the strike message ever lands.

Attackers profile the target via LinkedIn, news, SEC filings (for listed companies), and earlier phishing of a peripheral employee. They learn the CFO's communication style, the typical vendor approval workflow, and the format of internal emails. Then they compromise an account (often via OAuth abuse or credential phishing), monitor invoice cycles, and strike at exactly the right moment.

The Three Dominant Attack Patterns

Most BEC incidents fall into one of three patterns. Recognizing the pattern early is half the defense:

• CEO/CFO wire transfer fraud: spoofed or compromised executive account sends an urgent transfer request to finance, typically on Friday afternoon or just before a holiday. Pressure tactics, confidentiality framing, atypical urgency.
• Vendor invoice substitution: attacker monitors a real invoice cycle (often via compromised vendor account), then sends a 'banking details updated' email just before payment. The new account is attacker-controlled.
• Payroll diversion: HR receives 'please update my bank account for this month's salary' from a compromised employee account. Often hits multiple employees in the same payroll cycle.

Why Traditional Email Security Fails Against BEC

Modern email gateways (Microsoft Defender for Office 365, Proofpoint, Mimecast) catch 95%+ of generic phishing. They struggle with BEC for specific reasons:

• No malware: BEC emails carry no attachments, no links, just text. Nothing to scan.
• Legitimate sender: when the attacker has actually compromised a real account, technical email authentication (SPF/DKIM/DMARC) passes.
• Context-aware impersonation: attacker knows the right invoice number, the correct vendor name, the actual approval workflow.
• Sender-name spoofing: many BEC emails use display name spoofing that bypasses content filters but appears legitimate on mobile devices.
• Timing: attacks fire at moments of organizational stress (Friday close, board meeting, quarter-end) when verification feels burdensome.

The Four-Layer Defense Architecture

Effective BEC defense layers technology, identity, process and people. Each layer catches what the others miss:

• Layer 1: Email Gateway, advanced anti-phishing in Defender/Mimecast/Proofpoint, DMARC enforcement (reject policy), executive impersonation protection, banner warnings for external emails.
• Layer 2: Identity, MFA on every email account (no exceptions), conditional access blocking risky sign-ins, OAuth app review and restriction, leaked credential monitoring.
• Layer 3: Finance Process, mandatory out-of-band verification (phone callback to PRE-KNOWN number, never numbers from the email) for any wire transfer change, new vendor banking details, payroll changes. Dual approval for transfers over threshold.
• Layer 4: People, quarterly phishing simulation including BEC-specific scenarios. Specific finance team training on BEC patterns. Easy reporting channel (one-click report button in email).

Detection: Catching BEC in Progress

Sometimes prevention fails. Detection signals that suggest BEC in progress:

• Inbox rule creation: attackers create rules to auto-delete or forward verification emails. Microsoft 365 audit log catches these.
• Unusual sign-in patterns: impossible travel, new device, unusual time, anomalous app
• OAuth app additions: attackers often grant a malicious OAuth app rather than maintaining credential access
• Mass internal forwarding: attacker harvesting internal communications
• External wire transfer attempts to new beneficiaries flagged by banking systems
• Defender for Office 365 or third-party detection tools have BEC-specific signals; tune them for your environment

When BEC Succeeds: First-Hour Response

If a wire transfer has been initiated to a fraudulent account, the first hour matters more than everything else combined. The playbook:

• 0-15 minutes: confirm the fraud, document everything, contact the originating bank to attempt clawback (banks have 24-72 hour clawback windows; faster is better)
• 15-30 minutes: file FIR with cyber crime police, contact CERT-In via incident.cert-in.org.in, contact the receiving bank to freeze the destination account
• 30-60 minutes: notify your insurer (cyber and crime policies often cover BEC with specific reporting timelines)
• Hours 1-4: isolate any compromised email account, force password reset and re-authentication for all employees, scan for inbox rules and OAuth apps, begin internal investigation
• Hours 4-24: notify DPDP Data Protection Board if personal data was involved, brief leadership and customers if material, engage external forensics
• Recovery rate: clawback in the first 24 hours has 30-50% recovery success rate; after 72 hours drops below 10%