---
title: The 10 Stages of Business Email Compromise [infographic]
description: Business email compromise is a social engineering tactic that is frequently being deployed due to its high success rate. While BEC attacks can play out in many different ways, here's how a typical BEC attack unfolds...
image: https://blog.twinstate.com/hubfs/Blog/Featured%20Images/BlogFeaturedImg_10%20Stages%20of%20BEC.png
---

![twinstate technologies email security blog header](https://blog.twinstate.com/hs-fs/hubfs/website-header-texture-alt.png?width=300&name=website-header-texture-alt.png)

[Evan Clark](https://blog.twinstate.com/author/evan-clark)Jun 29, 2020 9:29:57 AM1 min read

# The 10 Stages of Business Email Compromise [infographic]

[Previous ](https://blog.twinstate.com/best-voip-phones-for-small-business-the-2020-buyers-guide)

<https://blog.twinstate.com>

[Next ](https://blog.twinstate.com/school-data-breaches-your-4-biggest-risks)

[In a business email compromise (BEC) attack,](https://www.fbi.gov/scams-and-safety/common-scams-and-crimes/business-email-compromise) an attacker will take control of someone's email account, either by [purchasing the login credentials on the dark web](https://www.twinstate.com/cybersecurity/iss/darkweb/are-you-being-sold-on-the-dark-web), cracking the password, or [phishing](https://www.twinstate.com/dont-get-hooked-by-phishing-scams) the information. The attacker will use this account to begin sending emails to individuals on the accounts contact list. These emails might contain links that will spread malware when clicked. Other times the emails contain requests for payment. This is particularly concerning because users are highly likely to click a link or trust a request that they think was sent to them by a friend or coworker.

## Business email compromise is a [social engineering](https://www.twinstate.com/social-engineering-learn-to-recognize-and-prevent-attacks) tactic that is frequently being deployed due to its high success rate.

 Learn the signs and don't fall victim to this popular social engineering tactic. While BEC attacks can play out in many different ways, here's how a typical BEC attack unfolds:   
![Infographic - Title: Ten Stages of a Business Email Compromise Attack. Main Content: Step 1 -Resarch. Criminals start hunting for an exploitable weakness or opportunity. Step 2 - identify a target. Based on their research, criminals decide what angle they're going to try to exploit, and which organization they are going to target. Step 3 - build a persona. Through web search, criminals can identify board members in the target organization. Step 4 - Identify a victim. Next, they look for an individual at the target organization who the criminals want to trick, Step 5 - spoof the email address. The attack starts with an email that appears to come from a senior leader. The crooks first spear phish the executive to get their credentials then log in as them to send their email. Step 6 - personalize the email. The criminals put all their research and persona building work to good use, crafting an email that appears to come from the senior leader. They add personalization (Dear Dave) and reference specific events (recent press releases), and request money transfer. ](https://blog.twinstate.com/hs-fs/hubfs/Blog/In%20Blog%20Images/infographic_BEC%20(top%20image).png?width=856&name=infographic_BEC%20(top%20image).png)![infographic_BEC (bottom image)](https://blog.twinstate.com/hs-fs/hubfs/Blog/In%20Blog%20Images/infographic_BEC%20(bottom%20image).png?width=856&name=infographic_BEC%20(bottom%20image).png)

If an attacker compromises a CEO's email account then they will often send emails to the finance department directing them to make an urgent money transfer to a specific bank account. These attacks are often successful by instilling a sense of urgency in the recipient so that they don't think twice about what they're doing.

Put a stop to this fraud with [email security](https://blog.twinstate.com/cybersecurity/email-security) and impersonation protection as well as user awareness training. Book a virtual meeting with one of our technology experts to learn how we can protect your organization.

![avatar](https://app.hubspot.com/settings/avatar/14ec542a027a83ff16146af2db443a18)

[Evan Clark

](https://blog.twinstate.com/author/evan-clark)

[mailto:evan_clark@twinstate.com](mailto:evan_clark@twinstate.com)<http://www.linkedin.com/in/iamevanclark>

COMMENTS

## RELATED ARTICLES

<http://www.mindmatrix.net>

```json
{
  "@context" : "https://schema.org",
  "@type" : "Organization",
  "address" : {
    "@type" : "PostalAddress",
    "addressCountry" : "United States",
    "addressLocality" : "Morrisonville",
    "addressRegion" : "NY",
    "postalCode" : "12962",
    "streetAddress" : "291 Rand Hill Road"
  },
  "knowsLanguage" : "en",
  "logo" : {
    "@type" : "ImageObject",
    "url" : "https://web.twinstate.com/hubfs/Twinstate_March2020%20Theme/images/logo.svg"
  },
  "name" : "Twinstate Technologies",
  "url" : "https://blog.twinstate.com/cybersecurity/the-10-stages-of-business-email-compromise-infographic"
}
```

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "abstract" : "Business email compromise is a social engineering tactic that is frequently being deployed due to its high success rate. While BEC attacks can play out in many different ways, here's how a typical BEC attack unfolds...",
  "author" : {
    "@type" : "Person",
    "name" : "Evan Clark"
  },
  "dateModified" : "",
  "datePublished" : "",
  "headline" : "The 10 Stages of Business Email Compromise [infographic]",
  "image" : "https://cdn2.hubspot.net/hubfs/6907413/Blog/Featured%20Images/BlogFeaturedImg_10%20Stages%20of%20BEC.png",
  "inLanguage" : "en",
  "keywords" : "[Cybersecurity]",
  "mainEntityOfPage" : {
    "@type" : "WebPage"
  },
  "name" : "The 10 Stages of Business Email Compromise [infographic]",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://web.twinstate.com/hubfs/Twinstate_March2020%20Theme/images/logo.svg"
    },
    "name" : "Twinstate Technologies"
  },
  "text" : "In a business email compromise (BEC) attack, an attacker will take control of someone's email account, either by purchasing the login credentials on the dark web, cracking the password, or phishing the information. The attacker will use this account to begin sending emails to individuals on the accounts contact list. These emails might contain links that will spread malware when clicked. Other times the emails contain requests for payment. This is particularly concerning because users are highly likely to click a link or trust a request that they think was sent to them by a friend or coworker. Business email compromise is a social engineering tactic that is frequently being deployed due to its high success rate. Learn the signs and don't fall victim to this popular social engineering tactic. While BEC attacks can play out in many different ways, here's how a typical BEC attack unfolds: If an attacker compromises a CEO's email account then they will often send emails to the finance department directing them to make an urgent money transfer to a specific bank account. These attacks are often successful by instilling a sense of urgency in the recipient so that they don't think twice about what they're doing. Put a stop to this fraud with email security and impersonation protection as well as user awareness training. Book a virtual meeting with one of our technology experts to learn how we can protect your organization.",
  "url" : "https://blog.twinstate.com/cybersecurity/the-10-stages-of-business-email-compromise-infographic",
  "wordCount" : "598"
}
```

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Evan Clark",
    "url" : "https://blog.twinstate.com/author/evan-clark"
  },
  "dateModified" : "2021-02-07T00:30:17.017Z",
  "datePublished" : "2020-06-29T13:29:57.000Z",
  "headline" : "The 10 Stages of Business Email Compromise [infographic]",
  "image" : [ "https://blog.twinstate.com/hubfs/Blog/Featured%20Images/BlogFeaturedImg_10%20Stages%20of%20BEC.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://blog.twinstate.com/cybersecurity/the-10-stages-of-business-email-compromise-infographic",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://blog.twinstate.com/hubfs/Twinstate_March2020%20Theme/images/logo.svg"
    },
    "name" : "Twinstate Technologies"
  }
}
```

```json
{
  "@context" : "http://www.schema.org",
  "@type" : "LocalBusiness",
  "address" : {
    "@type" : "PostalAddress",
    "addressCountry" : "United States",
    "addressLocality" : "Plattsburgh",
    "addressRegion" : "NY",
    "postalCode" : "12962",
    "streetAddress" : "291 Rand Hill Rd"
  },
  "contactPoint" : {
    "@type" : "ContactPoint",
    "contactType" : "customer service",
    "telephone" : "+1-518-563-7100"
  },
  "image" : "itemscope itemtype=http://schema.org/ImageObject",
  "name" : "Twinstate Technologies",
  "openingHours" : "Mo, Tu, We, Th, Fr 08:00-17:00",
  "priceRange" : "Telecommunications, IT and cybersecurity",
  "url" : "https://www.twinstate.com/"
}
```

```json
{
  "@context" : "http://www.schema.org",
  "@type" : "LocalBusiness",
  "address" : {
    "@type" : "PostalAddress",
    "addressCountry" : "United States",
    "addressLocality" : "Colchester",
    "addressRegion" : "VT",
    "postalCode" : "05446",
    "streetAddress" : "59 Rathe Rd Suite #105"
  },
  "contactPoint" : {
    "@type" : "ContactPoint",
    "contactType" : "customer service",
    "telephone" : "+1-802-655-7300"
  },
  "image" : "itemscope itemtype=http://schema.org/ImageObject",
  "name" : "Twinstate Technologies",
  "openingHours" : "Mo, Tu, We, Th, Fr 08:00-17:00",
  "url" : "https://www.twinstate.com/"
}
```

```json
{
  "@context" : "http://www.schema.org",
  "@type" : "LocalBusiness",
  "address" : {
    "@type" : "PostalAddress",
    "addressCountry" : "United States",
    "addressLocality" : "Concord",
    "addressRegion" : "NH",
    "postalCode" : "03301",
    "streetAddress" : "128E Hall Street"
  },
  "contactPoint" : {
    "@type" : "ContactPoint",
    "contactType" : "customer service",
    "telephone" : "+1-603-230-9598"
  },
  "name" : "Twinstate Technologies",
  "openingHours" : "Mo, Tu, We, Th, Fr 08:00-17:00",
  "url" : "https://www.twinstate.com/"
}
```

```json
{
  "@context" : "http://www.schema.org",
  "@type" : "LocalBusiness",
  "address" : {
    "@type" : "PostalAddress",
    "addressCountry" : "United States",
    "addressLocality" : "Latham",
    "addressRegion" : "NY",
    "postalCode" : "12110",
    "streetAddress" : ""
  },
  "contactPoint" : {
    "@type" : "ContactPoint",
    "contactType" : "customer service",
    "telephone" : "+1-518-783-0912"
  },
  "image" : "itemscope itemtype=http://schema.org/ImageObject",
  "name" : "Twinstate Technologies",
  "openingHours" : "Mo, Tu, We, Th, Fr 08:00-17:00",
  "url" : "https://www.twinstate.com/"
}
```

```json
{
  "@context" : "http://schema.org",
  "@type" : "Corporation",
  "alternateName" : "Twinstate",
  "contactPoint" : {
    "@type" : "ContactPoint",
    "areaServed" : "US",
    "availableLanguage" : "English",
    "contactOption" : "TollFree",
    "contactType" : "customer service",
    "telephone" : "+18008338000"
  },
  "logo" : "https://www.twinstate.com/hubfs/RevAcc/Marketing/Brand%20Twinstate/50th%20Anniversary/Logo_50thAnn_BlackBG.png",
  "name" : "Twinstate Technologies",
  "url" : "https://www.twinstate.com"
}
```

```json
{
  "@context" : "http://schema.org",
  "@type" : "Corporation",
  "alternateName" : "TwinState/Voice.Data.Video.Inc.",
  "logo" : "https://www.twinstate.com/hubfs/Assets/logo-twinstate-black-text.png?t=1534937469161",
  "name" : "Twinstate Technologies",
  "sameAs" : [ "https://www.facebook.com/TwinstateTechnologies", "https://www.twitter.com/_Twinstate", "https://www.linkedin.com/company/twinstate-technologies" ],
  "url" : "https://www.twinstate.com"
}
```

```json
{
  "@context" : "http://schema.org/",
  "@type" : "WebSite",
  "alternateName" : "TWINSTATE//VOICE.DATA.VIDEO.INC",
  "name" : "Twinstate Technologies",
  "potentialAction" : {
    "@type" : "SearchAction",
    "query-input" : "required name=search_term_string",
    "target" : "https://www.twinstate.com/search?q=){search_term_string}"
  },
  "url" : "https://www.twinstate.com"
}
```