BEC usually carries no malware and no bad link. It is a believable message, often from a lookalike domain or from a real mailbox the attacker has already taken over, asking for something normal: pay this invoice, change these bank details, send me the payroll file.
Because nothing in the message is technically malicious, standard spam and malware filters often let it through. The damage comes from a person acting on it.
The strongest BEC attacks start with an account takeover. The attacker reads the mailbox quietly, learns who pays whom, sets a rule to hide replies and then sends the request from inside the conversation.
Signs to look for
- A request to change bank details or pay urgently, outside the usual process
- A sender domain that is one letter off the real one
- A new inbox rule that forwards or hides mail, set shortly after an unusual sign-in
How Centeye handles it
Centeye Lighthouse looks at who is really writing, whether the domain is a lookalike and whether the request is unusual for that sender, then acts on every inbox the message reached. Centeye Gatewatch catches the account takeover that often comes first.
Lighthouse: email security →Go deeper: What is BEC?