Business Communications Compromise: The Next Evolution of Business Fraud

For years, business leaders have been warned about Business Email Compromise (BEC), a form of cybercrime in which attackers impersonate trusted individuals to trick employees into sending money or sensitive information. Today, however, many organizations face a broader threat. As businesses increasingly rely on platforms such as Microsoft Teams, Slack, Zoom, and other collaboration tools, attackers are expanding their techniques beyond email. This emerging threat is often referred to as Business Communications Compromise (BCC), a form of fraud that targets any trusted business communication channels rather than email alone.

Business Communications Compromise exploits the trust employees place in everyday workplace communications. Attackers are attempting to compromise a company user account, or simply launch the attack from their own disguised account to impersonate other users, customers, vendors, then inserting themselves into ongoing conversations. Unlike traditional phishing attacks, these fake communications appear legitimate since they originate from an authorized platform (like Microsoft Teams) and the communication from the attacker closely resembles normal business interactions from a trusted source.

Like other similar attacks, a typical Business Communications Compromise attack begins with reconnaissance. Threat actors gather information from social media, corporate websites, stolen credentials, or compromised accounts to understand organizational relationships and business processes. Once they have sufficient context, they may impersonate a company executive requesting an urgent wire transfer, a vendor submitting updated banking instructions, or a colleague seeking access to confidential information. The request is often timed to coincide with real projects, vendor payments, or executive travel schedules, making the fraud difficult to identify.

What makes this threat especially dangerous is that the attack often contains no malware, suspicious links, or obvious technical indicators. Instead, it relies on social engineering and manipulation of trusted communications. In some cases, attackers use compromised email accounts, while in others they leverage collaboration platforms and messaging tools to build credibility over time. Small and mid-sized businesses are particularly vulnerable because they often operate with lean staffing and fast-moving approval processes. A single fraudulent payment, payroll change, vendor account update, or disclosure of sensitive business information can result in significant financial losses and operational disruption. The success of these attacks is rarely due to a technology failure. More often, threat actors are exploiting gaps in business processes, verification procedures, and employee awareness. Organizations should therefore view Business Communications Compromise as a business risk, not merely an IT security issue.

The most effective defense combines process controls, user security awareness training with technology. Organizations should require multi-factor authentication on all email and collaboration platforms, monitor for unusual account activity, and implement protections such as SPF, DKIM, and DMARC for email security. Equally important are business controls, including dual approval requirements for financial transactions, independent verification of vendor payment changes, and out-of-band confirmation of urgent requests using trusted contact information. Finally, employees should be trained to verify unusual requests, even when they appear to come from their executives, supervisors, or trusted partners.