Business Email Compromise (BEC) is one of the costliest cyber frauds in the world: the FBI alone attributes losses of several billion dollars a year to it. It requires no malware, just a credible email sent at the right moment. And summer is the right moment.

Why Summer Is Peak Season

  • Out-of-office auto-replies tell fraudsters who is away, until when, and who is covering.
  • Replacements know the processes less well and hesitate to disturb a vacationing manager to approve a request.
  • Social media posts confirm that an executive is abroad and hard to reach.

The Three Most Common Scenarios

  • The fake banking details change — A "supplier" announces a new account for upcoming payments. Often the email comes from the supplier's real, hacked account and slips into an existing thread.
  • CEO fraud — A message signed by the executive asks for an urgent, confidential transfer: "I'm in a meeting, I can't talk."
  • The fake invoice — An invoice nearly identical to the real ones, with a usual amount, but modified payment details.

Signals That Should Trigger a Reaction

A slightly different sender address (one letter changed, another domain), an unusual tone of urgency or secrecy, a request to bypass the normal process, or any change of banking details — even from a known contact.

The Rule That Stops Almost Everything

Set one simple, non-negotiable rule: any change of banking details or any unusual transfer is confirmed by phone, at a number already on file — never the one given in the email. This single check defeats the vast majority of attempts.

On the technical side, three measures sharply reduce the risk: MFA on every Microsoft 365 mailbox (to prevent your own accounts from being hijacked), SPF, DKIM, and DMARC configured on your domain (to prevent spoofing of your address), and an alert on automatic forwarding rules created in mailboxes, a classic fraudster technique.

Train Before the Holidays

A five-minute reminder before vacation, with concrete examples, beats a long annual training session nobody remembers. Our simulated phishing campaigns measure who clicks, train in the moment, and track your team's progress.