Business Email Compromise: A Practical Guide for UK Businesses

An email arrives from a regular supplier. Their bank details have changed, and an outstanding invoice needs paying.

The name is familiar. The conversation looks genuine. The request seems reasonable.

But the payment goes to an attacker.

This is business email compromise (BEC): using convincing emails to persuade someone to transfer money, share sensitive information or take another action that benefits a criminal.

For UK businesses, preventing it takes technology, awareness and clear processes.

What Is Business Email Compromise?

BEC is a targeted form of email fraud. Criminals impersonate someone your organisation trusts, or use a compromised account to make a fraudulent request.

Unlike phishing campaigns built around malicious links or attachments, a BEC email may contain neither. The message itself does the work.

Common examples include:

• Supplier impersonation: A request to pay an invoice into a new bank account.
• Director impersonation: An urgent, confidential instruction to transfer money.
• Payroll fraud: A request to change an employee’s salary payment details.
• Conversation hijacking: An attacker joins an existing email thread and redirects a legitimate transaction.

The aim is to make a dangerous request feel like routine business.

How Does an Attack Work?

Consider a supplier whose email account has been compromised.

An attacker reads existing conversations, identifies an upcoming payment and sends revised bank details within the genuine email thread.

Your finance team recognises the sender and invoice. The payment is expected. Nothing appears obviously wrong.

Checking spelling, logos and the sender’s address can help, but cannot establish that a payment request is genuine.

Where Does AI Fit into Email Protection?

When an email contains no malicious attachment or link, detecting the threat means looking beyond its technical contents.

AI-based email protection can analyse communication patterns, relationships and message content to identify unusual requests. For example, a payment instruction that differs from an employee’s normal exchanges may warrant closer investigation.

IRONSCALES describes this approach as learning normal communication behaviour and assessing deviations alongside sender authentication and reputation checks. Automation can then help group related threats and remove confirmed malicious messages, according to configured policies.

An unusual email is not automatically fraudulent, and AI cannot guarantee that every attack will be caught. Its value is another layer of detection and faster response, alongside human judgement and established controls.