How to Protect Your Saudi Business from Business Email Compromise
Business Email Compromise doesn’t look like the crude, typo-riddled phishing email most people picture when they hear “email scam.” A modern BEC attack looks like an ordinary internal email thread. Picture a CFO asking Accounts Payable to process an urgent wire transfer, a supplier notifying a customer of “updated” banking details, or a CEO texting an assistant from what appears to be their usual number, asking for a favor before a flight. There’s no malware attachment to scan, no suspicious link to flag. The entire attack is social engineering wrapped around a compromised or spoofed email account. It is one of the costliest categories of cybercrime globally, consistently ranked among the top financially damaging attack types by the FBI’s Internet Crime Complaint Center https://www.ic3.gov — precisely because it targets the trust inside routine business communication rather than a technical vulnerability.
Why BEC Is Different From Ordinary Phishing
Traditional phishing casts a wide net and relies on a percentage of recipients clicking a malicious link or opening an infected attachment. BEC is targeted, patient, and often preceded by real reconnaissance. An attacker may spend weeks monitoring a compromised mailbox — learning who approves payments, how invoices are normally worded, and when a real business trip or acquisition makes an unusual request plausible — before ever sending the message that matters.
This is also why BEC is unusually hard to catch with traditional security tools. A well-crafted BEC email often contains no malware and no obviously malicious link — just a request, timed and worded to feel routine, sent from an account or domain that looks legitimate at a glance.
The Most Common BEC Patterns
- **CEO/executive impersonation:** an email or message appearing to come from a senior executive, requesting an urgent wire transfer or gift card purchase, usually while claiming to be traveling or unavailable by phone.
- **Vendor/supplier email compromise:** an attacker gains access to a real supplier’s mailbox (or spoofs their domain closely) and sends an “updated bank details” notice ahead of a legitimate invoice payment.
- **Payroll diversion:** a message impersonating an employee, asking HR or payroll to redirect salary deposits to a new account.
- **Attorney/deal impersonation:** particularly around real mergers, acquisitions, or large contracts, where urgency and confidentiality are already expected, making an unusual request feel less suspicious.
Technical Controls: The First Line of Defense
ThThree DNS-based email authentication standards form the technical foundation against domain spoofing, and all three need to be present and properly enforced — not just one:
– **SPF** specifies which mail servers are permitted to send email on behalf of your domain, so receiving servers can reject messages from unauthorized sources claiming to be you.
– **DKIM** attaches a cryptographic signature to outgoing mail, letting recipients verify the message wasn’t altered and genuinely came from an authorized sender.
– **DMARC** ties SPF and DKIM together with an enforcement policy — telling receiving servers what to do with messages that fail those checks (quarantine, reject, or take no action). It also provides reporting so you can see spoofing attempts against your own domain as they happen.
A domain with SPF and DKIM configured but DMARC left at “none” is common — and means the organization has visibility into spoofing attempts without actually blocking any of them. Moving DMARC enforcement to “quarantine” and eventually “reject,” once you’ve confirmed legitimate mail flows aren’t affected, is what converts this from a monitoring tool into an actual barrier.
Beyond DNS: Anti-Phishing and Impersonation Protection
Modern email security platforms (including Microsoft Defender for Office 365 and equivalent Google Workspace protections) include impersonation-detection features. These specifically watch for messages that mimic your own executives’ display names or closely resemble your domain — a lookalike domain differing by one character is a very common BEC setup step. These should be explicitly configured to protect your organization’s named executives and finance team — not left at platform defaults, which typically protect only against the most obvious cases.
The Human Control That Actually Stops Wire Fraud
Every technical control above reduces how many suspicious messages reach an inbox. None of them can fully stop a well-crafted, targeted BEC email from a compromised real account, because there may be nothing technically wrong with the message at all. The control that actually stops fraudulent payments is procedural: a callback verification policy for any payment or banking-detail change. Use a phone number retrieved independently from an existing contact record — never one supplied in the request itself — before funds move.
This single habit — applied without exception regardless of how senior the requester appears to be or how urgent the message sounds — is the most effective BEC defense available. It also costs nothing to implement. The organizations that lose money to BEC are almost never the ones with weak technology; they’re the ones where “the CFO said it was urgent” was enough to skip the callback.
Building an Incident Response Plan for BEC
Because BEC often isn’t caught until after a fraudulent transfer has already been requested — or, worse, already sent — every organization handling wire payments should have a documented, rehearsed response plan:
1. **Immediate internal reporting path** — staff need to know exactly who to tell the moment something feels off, without fear of blame for having almost fallen for it.
2. **Bank contact procedure** — most banks can attempt to recall or freeze a fraudulent transfer if notified within hours, not days. Knowing who to call, and having that number ready before an incident, matters.
3. **Account compromise checklist** — if the attack involved a compromised mailbox (yours or a vendor’s), that account needs password resets, session revocation, and a review of mailbox rules attackers commonly create to auto-forward or hide reply traffic.
4. **Law enforcement and regulatory notification**, where applicable under Saudi PDPL or sector-specific requirements.
Closing the Gap
BEC defense works best as a layered approach: DNS-level authentication and enforcement to reduce spoofed mail reaching inboxes, platform-level anti-impersonation tuning to catch what gets through, and a non-negotiable callback verification habit for anything involving money or banking details. None of these are exotic or expensive controls — they’re consistently the gap between organizations that read about a BEC attempt after the fact, and organizations that lose real money to one.
—
*SirajTech configures SPF, DKIM, DMARC enforcement, and anti-phishing policies as part of Microsoft 365 hardening and managed security engagements for Saudi businesses.*(contact)