Business email compromise (BEC) is a fraud in which criminals use email to impersonate a trusted person, such as an owner, manager or supplier, to trick someone into transferring money, changing bank details or revealing sensitive information. It often involves no malware at all.
Attackers either take over a real mailbox, often after stealing a password through phishing, or create a lookalike address. They then send a convincing message, for example a supplier "advising new bank details" for an upcoming invoice, or an urgent request from the "boss" for gift cards or a quick payment.
Retail and hospitality businesses are exposed because accounts staff pay many supplier invoices, franchisees deal with head office, and owners are often busy and travelling. Payroll diversion, where a staff member's pay is redirected to a new account, is another form.
Defences are mostly process and basic technology: verify any change of bank details by phoning a known number, require two people to approve large or new payments, turn on multi-factor authentication for email, and enable email filtering. Report suspected scams promptly to your bank, and to Scamwatch and ReportCyber.
Losses can be large and hard to recover, so a simple payment verification rule is one of the best protections a small business can adopt.