BEC

How it works

• The attacker learns who pays whom, often by quietly reading a hacked mailbox for weeks.
• When an invoice is due, they send a message from the real mailbox or a lookalike domain one letter off, with new bank details.
• Variations include a fake boss asking for gift cards and a fake employee asking HR to change a direct deposit.
• The email usually has no link and no attachment, which is why filters struggle to catch it.

What can go wrong (example scenario)

A three-person construction firm got an email from their steel supplier's real address saying the bank had changed. They paid a $38,000 invoice to the new account. The supplier's mailbox had been compromised for a month. The real supplier still wanted paying.

How WILDCARD handles it

Email Security filters inbound and outbound mail in real time and watches for lookalike domains, spoofed display names and payment-change language. Phishing Training builds the habit of confirming changes by phone. Domain Security protects your own domain from being spoofed.

• A law firm's trust account is targeted with a fake “closing funds” redirection from a lookalike real estate agent address.
• A dental office receives a supplier invoice with new banking details and a request to pay today.
• A non-profit's bookkeeper gets an “urgent” email from the executive director asking for gift cards for volunteers.

Example scenario: A small landscaping company's office manager received a message from the owner's address, while he was on site, asking her to pay a new equipment vendor by e-transfer. She phoned him before sending anything. His mailbox had been compromised that week, and a hidden rule was forwarding every message to an outside address.

A question owners ask

If the email came from a real address, how could I have known?

You often can't by looking. Any change to payment details gets confirmed by phone, using a number you already had. Filtering reduces how many of these reach you, and the phone call catches the rest.