In BEC, attackers impersonate a manager or supplier to redirect payments. Many BEC attacks contain no link or attachment at all, so filters miss them. A compromised supplier mailbox is especially convincing.
The short version
Start with what already exists. Most organisations have routines, documents or tools that cover part of the need, and connecting them is faster than building something new.
A quick check
- Treat any change of bank details as high risk
- Watch for lookalike domains
- Monitor mailbox rules for forwarding
Making it stick
Losses from BEC are often larger than from ransomware. Review the result after three months and adjust. What works in practice is worth more than what looks complete on paper.