What is business email compromise (BEC)?

Business email compromise (BEC) is a category of fraud in which attackers use email — by compromising a legitimate account, spoofing a domain, or impersonating a trusted sender — to deceive an employee into transferring money, sharing credentials, or disclosing sensitive information. BEC does not require malware or a technical breach. It exploits email as a communication channel and human trust in email identity. The FBI reports BEC as consistently the highest-loss cybercrime category, with Florida businesses among the top targets due to the concentration of real estate transactions, law firms, and healthcare practices in the state.

What are the most common BEC attack types targeting Florida businesses?

The four BEC variants most commonly targeting Florida businesses are: (1) CEO or executive impersonation — an email appearing to come from the owner or senior executive asking an employee to wire funds urgently; (2) vendor or supplier impersonation — a fraudulent email from an apparent known vendor requesting a change to banking details; (3) real estate wire fraud — interception of closing communications to redirect wire transfer instructions; and (4) payroll diversion — a request to change direct deposit information to an attacker-controlled account. Real estate wire fraud is particularly prevalent in Florida given the state's high transaction volume.

How do attackers compromise business email accounts?

Attackers compromise business email accounts primarily through credential phishing, credential stuffing using leaked passwords from other breaches, and password spraying. Once inside, attackers typically monitor the inbox for weeks before acting — learning communication patterns and waiting for an opportunity to insert fraudulent payment instructions. MFA on the email account is the primary control that prevents initial account compromise regardless of how the attacker obtained the password.

How can a Florida business detect a BEC attack in progress?

BEC attacks in progress can be detected by: inbox rules created by unknown processes that forward or delete specific emails; new mail connectors or forwarding rules in the email admin console; login activity from unexpected geographic locations or IP addresses in the email audit log; and the presence of new inbox rules the account owner did not create. Microsoft 365 and Google Workspace both provide audit logs that show when inbox rules were created and modified — reviewing these weekly, or using a tool that alerts on anomalous rule creation, is an effective early detection method.

What is the most effective technical control against BEC?

The most effective technical controls against BEC are: (1) MFA on all email accounts — prevents initial account compromise; (2) email authentication (SPF, DKIM, DMARC with reject policy) — prevents domain spoofing; (3) email filtering with impersonation detection — flags emails that appear to come from executives or known vendors but originate from unexpected domains; and (4) a documented out-of-band verification procedure requiring a phone call to a previously known number before any payment change or wire transfer is executed.

Business Email Compromise in Florida — How the Attack Works and How to Stop It

← Back to Blog

Cybersecurity

Business Email Compromise in Florida — How the Attack Works and How to Stop It

Name: Simply IT
Address: 4269 NW 44th Ave Suite C, Ocala, FL, 34482, US
Telephone: +1-352-723-5003
Price range: $$
Rating: 5.0

July 4, 20268 min readSteve Condit — Founder, Simply IT

Cybersecurity

Business email compromise is the highest-dollar cybercrime affecting Florida small businesses — not ransomware. BEC requires no malware, no technical breach, no sophisticated hacking. It requires an email, a convincing pretext, and an employee who follows payment instructions without verification. Florida's concentration of real estate closings, law firm wire transfers, and healthcare billing makes the state one of the top BEC targets nationally. Understanding exactly how each variant works is the first step to stopping it.

$140M+

BEC losses reported by FL businesses 2025

$137K

Average loss per BEC incident

Malware required — BEC is pure social engineering

62%

Of BEC starts with a compromised email account

The 4 BEC Variants Florida Businesses Face

CEO / executive impersonation

An email appearing to come from the business owner or a senior executive asks an employee — typically accounts payable or an office manager — to process an urgent wire transfer or purchase gift cards for a client. The email is often sent from a lookalike domain or from a free email account. The urgency, the authority of the apparent sender, and the instruction not to discuss the matter create psychological pressure to act without verification. This variant requires no technical access — only a convincing domain and a publicly available email address.

Vendor / supplier impersonation

An email appearing to come from a known vendor notifies the business that their banking information has changed and that future payments should go to a new account. The email may be a domain spoof of the real vendor, or it may come from a compromised vendor email account. The business processes the next payment to the attacker-controlled account — often without realizing anything is wrong until the vendor follows up about the missed payment weeks later.

Real estate wire fraud

Attackers monitor email communications between buyers, sellers, real estate agents, title companies, and law firms to intercept closing instructions. When wire instructions are sent by email, the attacker intercepts or spoofs the communication and substitutes attacker-controlled account details. The victim wires closing funds — which can be hundreds of thousands of dollars — to the wrong account. This variant is endemic in Florida given the state's real estate transaction volume.

Payroll diversion

An employee or someone impersonating an employee contacts HR or payroll with a request to change direct deposit information before the next payroll cycle. If the request is processed without identity verification, the next payroll deposits into the attacker-controlled account. This variant is especially effective against businesses using email-based HR processes without a separate identity verification step for banking changes.

Technical Controls That Stop BEC

MFA on all email accounts — blocks credential-based account takeover. Attackers operating from inside a compromised inbox are far more convincing and far harder to detect than external spoofers.
Email authentication (SPF, DKIM, DMARC reject) — prevents lookalike domains and your own domain from being spoofed. A business without DMARC enforcement is allowing anyone to send email that appears to come from their domain.
Email filtering with impersonation detection — flags emails where the display name claims to be an executive but the sending domain does not match. Microsoft Defender for Office 365 includes impersonation protection rules specifically for this pattern.
Out-of-band verification procedure — the process control that no technical tool can replace: any change to payment information must be verbally confirmed by phone call to a previously verified number before execution. Document this procedure and enforce it without exceptions.

// Did You Know?

When an attacker compromises a business email account, one of the first things they do is create an inbox rule that automatically deletes emails from certain senders or moves them to obscure folders. This hides their activity from the legitimate account owner. Checking for unexpected inbox rules — in Outlook settings and in the Microsoft 365 admin center — is one of the fastest ways to identify an active account compromise before a fraudulent transfer occurs.

// Key Takeaway

BEC is stopped by the combination of MFA on email accounts, DMARC enforcement on your domain, impersonation detection in your email filter, and a documented payment verification procedure that does not allow email alone to authorize a wire transfer. Simply IT implements and manages all four for North Central Florida businesses — and produces the audit documentation that cyber insurance carriers require when a BEC claim is filed.

Get a Free Email Security Assessment →

// Written By

STEVE CONDIT

Founder & Owner, Simply IT · US Marine Veteran · 30+ Years IT Experience

Steve Condit founded Simply IT to bring enterprise-grade IT management to small and mid-sized businesses across North Central Florida. With over 30 years of IT experience and a background in the US Marine Corps, Steve built Simply IT around the principle that local businesses deserve the same quality of technology partnership that large companies take for granted — without long-term contracts or national call center support.

Full Bio →LinkedIn →About Simply IT →