Phishing and BEC: How They Reach the Inbox and How to Stop Them

Most serious breaches start with an email. Phishing tries to steal credentials or install malware. Business email compromise (BEC) goes after money: a fake invoice, a changed bank account, a message that looks like it comes from your finance director. Both are cheap for attackers and often work.

How these emails get through

• Spoofed or look-alike domains. A single changed letter in the sender address passes a quick glance.
• Compromised real accounts. An email from a supplier’s genuine mailbox passes every technical check.
• Links that change after delivery. A link is clean when the email arrives and malicious a few hours later.
• No malware at all. BEC messages contain plain text, so there is nothing for an antivirus filter to catch.

Warning signs your team can learn

• Urgency and secrecy: “pay today, do not discuss”.
• A change to bank details or a new payment route.
• A sender whose address is slightly different from the usual one.
• A request to log in through a link instead of the normal bookmark.
• An unexpected attachment, especially a shared-document notice.

The layers that stop them

1. Email authentication. SPF, DKIM and DMARC make it hard to spoof your own domain and help others trust your mail.
2. Advanced email filtering. Modern gateways, such as Proofpoint, scan links at the moment of click and inspect attachments in a sandbox.
3. Multi-factor authentication. A stolen password is not enough to take over an account.
4. Payment controls. Verify any change of bank details by phone, using a number you already hold, and require two approvers for transfers over a limit.
5. Awareness training and simulations. Staff who practise spotting phishing report more and click less.
6. Monitoring. Rules that flag forwarding rules, impossible travel and unusual logins catch accounts that were taken over.

If someone clicked

Do not blame the person. Reset the password, revoke active sessions, check mailbox rules, and tell your security team quickly. Speed matters far more than who made the mistake.

How Guardbyte can help

We deploy and manage email protection, set up DMARC, and run security awareness training with phishing simulations. Add multi-factor authentication and you cover the three most common ways attackers get in. Contact us to review your current setup.