Every year, the FBI's Internet Crime Complaint Center logs billions of dollars in losses tied to a single attack category: Business Email Compromise, or BEC. Unlike ransomware or phishing kits that harvest passwords, a BEC attack doesn't need to break into anything. It just needs one employee to trust an email that looks, sounds, and reads exactly like it should.

That's what makes BEC so hard to stop with technology alone — and why Email Decoded builds an entire running case study around it, following a fictional finance team through the moment an invoice email arrives that looks completely routine.

The setup: why the email looks legitimate

A convincing BEC attack rarely relies on a forged sending domain. Attackers know that a spoofed domain is exactly what SPF, DKIM, and DMARC were built to catch. Instead, the more effective (and increasingly common) approach uses one of two techniques:

  • A lookalike domain — registering something visually close to the real vendor's domain, sometimes using homograph characters that render identically in most email clients.
  • A compromised mailbox — sending the email from a real, previously legitimate account that authenticates perfectly, because it is perfectly authenticated. The account itself was the point of failure, not the protocol.

Both techniques share one goal: pass every automated check a receiving server runs, so the message lands in the inbox looking exactly as trustworthy as the hundred other invoices that arrived that week.

What the headers actually reveal

This is where email forensics becomes the deciding factor. A message that passes SPF and DKIM isn't automatically safe — it just means the sending infrastructure was authorized to send as that domain. If the domain itself is one character off from the real vendor, authentication passes flawlessly while the message is still fraudulent.

Reading the raw headers surfaces details a glance at the inbox never will: the actual Return-Path, the chain of Received hops showing where the message actually originated, and — critically — whether the visible From: display name matches the domain in the authenticated header underneath it. A mismatch between what's displayed and what's authenticated is one of the clearest BEC signals there is, and it's invisible unless you know to look for it.

Why DMARC alone isn't the full answer

DMARC tells a receiving server what to do when SPF and DKIM fail alignment — but a lookalike domain doesn't fail alignment. It's a different domain, authenticated correctly, doing exactly what it's configured to do. This is the gap that catches even security-conscious teams off guard: DMARC protects a domain from being spoofed, not from a nearly-identical domain acting on its own perfectly valid authority.

Closing that gap takes a combination of technical controls (display-name and lookalike-domain detection at the gateway) and something no filter can fully replace: a finance team that knows how to glance at a header and ask the right question before a wire transfer goes out.

The takeaway

A BEC attack succeeds not because email security failed, but because it worked exactly as designed — for a domain that was never the real one. Understanding that distinction is the difference between a routine Tuesday and a very expensive one.

Email Decoded walks through this exact scenario — and eleven others — showing the full header trail an investigator would pull apart to catch it, chapter by chapter, from the first suspicious login to the final incident report.