Your Email Is the Front Door. Is It Locked?
Over 80% of cyber incidents start with a phishing email. Not malware. Not a brute-force attack on your firewall. An email, sent to someone busy, opened out of habit.
For most UK businesses, email is the single most critical and most exposed system they operate. It is where invoices are sent, where client data flows, where payment instructions are given. And it is where attackers want to be.
Business Email Compromise: The Fraud That Does Not Need a Hack
Business Email Compromise, or BEC, is one of the most financially damaging forms of cybercrime facing UK businesses today. It does not rely on breaking encryption or deploying malware. It relies on a convincing email and a finance process with no second check.
Globally, BEC attacks accounted for 73% of all reported cyber incidents in 2024. In the UK, phishing was experienced by 38% of businesses last year and was rated the most disruptive attack type by 69% of those it hit. Business email compromise and social engineering are now the highest-grossing threat types for cybercriminals, ahead of ransomware.
In April 2026, a UK energy company lost £700,000 from a single redirected supplier payment. The attacker compromised an email account, altered bank details on a legitimate invoice, and the money was gone before anyone noticed. No malware. No hacking. A convincing email and a process that did not catch it.
How It Works
BEC takes a few recurring forms, and most real incidents are a variation on one of them.
Invoice redirection. The attacker poses as a genuine supplier and emails to say their bank details have changed. The next legitimate payment goes to the fraudster’s account. This is the pattern behind most large single losses.
CEO or executive fraud. An email appearing to come from a senior leader asks a finance team member to make an urgent, confidential payment. The urgency and the apparent authority are designed to bypass normal checks.
Account compromise. The attacker gains access to a real internal or supplier mailbox, often through a phished password, and sends requests from a genuine address. This is the hardest form to detect, because the email really is coming from the right account.
The typical timeframe for BEC fraud to be detected is around 28 days. That is four weeks of an attacker potentially sitting in your email, watching how your business communicates, learning your payment processes, and waiting for the right moment.
Why SMEs Are Hit Hardest
42% of UK small businesses experienced a cyber breach or attack in 2025. Only 39% of SMEs provide cyber security training to their employees. That gap, between exposure and preparation, is where BEC thrives.
Large organisations have dedicated security teams, automated payment controls and multi-layered approval processes. Most SMEs do not. A single person often handles finance. Payment approvals might be informal. And there is no second check when bank details change on an invoice.
The result is that the typical SME loss is a single, well-targeted payment rather than a high volume of small ones. A loss of tens or hundreds of thousands of pounds in one transfer can threaten the survival of the business.
The Defences That Work
BEC is preventable. The defences are not expensive or complicated. They need to be in place.
Multi-factor authentication on every email account. MFA blocks 99.9% of account compromise attacks. Even if an employee hands over their password to a phishing email, the attacker cannot log in without the second factor. This is the single most impactful control you can implement.
Anti-spoofing email controls. SPF, DKIM and DMARC are three DNS records that stop attackers sending emails that appear to come from your domain. Without them, anyone can send an email that looks like it is from your business. With them, those emails get flagged or blocked.
A verification process for payment changes. Any change of bank details, from a supplier, from a client, from anyone, gets verified by phone on a known number, never by replying to the email. This single procedural control stops most invoice redirection fraud.
Staff training. Finance, HR and payroll teams need to recognise the warning signs: unexpected changes to bank details, pressure to act urgently or confidentially, and requests that bypass the usual process. Staff need explicit permission to pause and verify without being seen as obstructive.
Monitoring. Systems that watch for unusual activity: sign-ins from odd locations, forwarding rules nobody set up, behaviour that does not fit the pattern. The earlier it is seen, the smaller the damage.
The Question Worth Asking
If someone compromised your email account today, how long until you noticed?
If the answer is that you are not sure, that is the gap. And that gap is where BEC lives.
The businesses that take email security seriously before an incident never have to make the phone call explaining how client data was exposed or why a payment went to the wrong account. The cost of prevention is small compared to the cost of being compromised.
Find Out Where Your Practice Stands
Our free Business IT Health Check includes an assessment of your email security posture. It takes less than 5 minutes, it is written in plain English, and there is no hard sell at the end. Just an honest picture of where you stand, before someone else finds out for you.
