What is a business email compromise attack?
A business email compromise (BEC) attack is when a criminal sends an email that looks like it came from someone you trust — your bank, a supplier, or even your own boss. The goal is usually to get money sent somewhere it shouldn’t go, or to get hold of sensitive information. These attacks cost businesses real money, and they work because the emails can look completely genuine.
You don’t need to be a large company to be targeted. Criminals cast a wide net, and small and medium-sized businesses are often easier targets precisely because they have fewer protections in place.
Domain squatting: when criminals copy your address
One common trick is called domain squatting. A criminal registers a domain name that looks almost identical to yours — swapping a letter, adding a hyphen, or using a different ending like .net instead of .co.uk. They then send emails from that fake domain, and at a glance the address looks right.
If your domain is computercare.co.uk, a squatter might register c0mputercare.co.uk or computercare-uk.com. Recipients often don’t spot the difference, especially when they’re busy.
Supply chain attacks: the threat that comes through people you already trust
A supply chain attack takes a different approach. Instead of impersonating you directly, criminals compromise the email account of one of your suppliers or partners. They then send emails to you from a real, legitimate address — one you might have been dealing with for years.
Because the email genuinely comes from your supplier’s domain, it passes many standard checks. You trust the sender, so you’re more likely to act on what it says. This is what makes supply chain attacks particularly difficult to defend against.
What’s already in place to help?
Email authentication has been around for a while, and the most basic layer is called SPF — Sender Policy Framework. SPF lets a domain owner publish a list of mail servers that are allowed to send email on their behalf. When an email arrives, the receiving server can check whether it came from an approved source.
SPF is a reasonable starting point, but it has real limitations. It doesn’t protect against emails where the visible "From" address is forged, which is exactly what happens in many BEC attacks. It also breaks when emails are forwarded, which is a common and frustrating problem.
Why DKIM and DMARC are a significant step forward
DKIM — DomainKeys Identified Mail — adds a digital signature to every email sent from your domain. That signature travels with the message and can be verified by the recipient’s mail server. If the email has been tampered with in transit, the signature won’t match and the email fails the check.
DMARC — Domain-based Message Authentication, Reporting and Conformance — sits on top of both SPF and DKIM and ties them together properly. It tells receiving mail servers what to do when an email fails authentication: deliver it, quarantine it, or reject it outright. Crucially, DMARC also checks that the domain in the visible "From" address matches the domain that passed authentication. That’s the check that SPF alone simply cannot do.
Together, DKIM and DMARC make it much harder for criminals to convincingly impersonate your domain. They don’t eliminate all risk — supply chain attacks, for instance, still require other defences — but they significantly raise the bar.
DMARC isn’t a one-time setup
This is where many businesses go wrong. DMARC is not something you configure once and forget. Getting the most out of it requires ongoing attention, and here’s why.
When you first enable DMARC, you typically set it to monitor mode — meaning it reports on what’s happening without blocking anything. Those reports are essential. They tell you which servers are sending email on behalf of your domain, whether legitimately or not. Without reviewing them, you’re flying blind.
Over time, you need to move DMARC through its policy stages — from monitoring, to quarantine, to reject — which is when it actually starts blocking fraudulent emails. Moving too quickly can accidentally break legitimate email flows, such as automated messages from your CRM or marketing tools. Moving too slowly leaves you exposed.
Then there are ongoing changes to consider. Every time you add a new service that sends email — a newsletter tool, a helpdesk system, a new supplier portal — your DMARC configuration may need updating. If you don’t keep on top of it, legitimate emails start failing authentication and go missing.
We work with PowerDMARC to help our customers manage this properly. Their platform makes the reporting readable for non-technical people and flags issues before they cause problems. It turns what could be a confusing stream of raw data into something you can actually act on.
Who needs to care about this?
If your business sends or receives email — which is every business — then this matters to you. BEC attacks are one of the leading causes of financial loss from cybercrime in the UK. The National Cyber Security Centre has published guidance on this, and it’s worth being aware of: ncsc.gov.uk.
Setting up DMARC properly also matters if you hold cyber insurance or are thinking about getting it. Insurers increasingly look at whether basic email authentication controls are in place when assessing risk and setting premiums.
What good looks like
A well-protected business will have SPF, DKIM and DMARC all configured correctly, with DMARC at a reject policy so unauthorised emails are blocked before they reach anyone’s inbox. They’ll also have someone reviewing the DMARC reports regularly and updating the configuration as the business changes.
This won’t stop every attack — particularly supply chain attacks, which require additional controls around payment processes and verification procedures. But it does stop criminals from sending emails that appear to come directly from your domain, and that alone removes a significant slice of the risk.
If you’d like to know whether your domain has DMARC in place and whether it’s configured correctly, we’re happy to take a look. It’s a straightforward check, and you’ll know where you stand.