BEC (Business Email Compromise): how to protect your firm in 2026

In 2024, the FBI recorded $2.77 billion in global losses linked to BEC. In France, Cybermalveillance.gouv.fr estimates that email identity-theft fraud costs professionals tens of millions of euros every year. And yet most law, accounting and notarial firms still think their spam filters protect them.

They don't. Here's why, and what exists today to fix it.

What exactly is BEC?

Business Email Compromise (BEC) is a fraud in which an attacker impersonates a legitimate sender to trick a recipient into taking an action: a bank transfer, disclosure of confidential data, or a change of bank details (fake payment instructions).

What sets BEC apart from classic phishing is its precision. The attacker doesn't target just anyone with a generic email. They target a specific person, at the right time, with the right context. They know your name, your role, and those of your contacts. They know you're expecting an invoice from that supplier. They know your CFO is travelling.

The result: an email that looks nothing like a suspicious one. No spelling mistakes. No odd sender. A message that appears to come exactly from the expected person.

Why firms are particularly exposed

Regulated professions – lawyers, accountants, notaries – combine three factors that make them prime BEC targets.

First, the volume of sensitive emails. A firm sends wire instructions, bank details, deeds and confidential data every day. Each email is an opportunity for an attacker to intercept or impersonate.

Second, the relationship of trust. A firm's clients trust their lawyer or accountant. When an email appears to come from the firm, the client complies without checking. This trust is exactly what BEC exploits.

Third, legal liability. A firm whose identity is impersonated can end up involved in a dispute even if it did nothing wrong. Recent case law more broadly reminds us that the question of proof and vigilance is becoming central in wire-fraud disputes.

The three most common BEC scenarios in firms

1. Fake bank details

The attacker intercepts or monitors communications between a firm and its client. At the time of a major payment, they send an email appearing to come from the firm with altered bank details. The client transfers the funds to the fraudster's account. The firm discovers the fraud when chasing payment.

This is the most documented scenario in France. Real-estate transactions, large fee payments and refunds of overpayments are the prime targets.

2. Executive impersonation ("CEO fraud")

An email appearing to come from the managing partner requests an urgent, confidential transfer from a staff member or client. The urgency and confidentiality are designed to bypass normal verification procedures.

3. The compromised account

This is the hardest scenario to detect. The attacker has genuine access to the firm's mailbox, via a stolen password, a hijacked session cookie, or an MFA bypass. They send emails from the real address, with the real conversation history. No filter sees anything unusual.

What conventional solutions don't cover

Most firms have one or more of the following in place:

• SPF, DKIM, DMARC: these protocols check that an email comes from the right sending server and domain. They are essential. But they don't verify the identity of the person who hit "send". If the account is compromised, the email leaves the right server, with the right domain. SPF, DKIM and DMARC all pass. The attack goes undetected.
• Anti-spam and inbound filters: these solutions analyse incoming emails to detect threats. They're useful against inbound phishing. But they don't certify the emails you send. They don't prove that you actually sent a given message.
• Staff training: an ETH Zurich study (Lain, 2023) of 14,733 employees over 15 months found that employees trained to spot phishing weren't significantly more resistant to sophisticated attacks. Human vigilance erodes. Time pressure, fatigue and context mean no one can maintain maximum attention on every email received.

What regulation requires, and what's coming

The NIS2 directive, expected to be transposed into French law in summer 2026, imposes communication-security obligations on essential and important entities. Regulated professions are covered.

The eIDAS 2.0 regulation, in force since 2024, strengthens the legal value of qualified digital evidence across Europe. A qualified RFC 3161 timestamp issued by a qualified trust service provider (QTSP) can constitute a technical piece of evidence recognized by European courts.

In other words: regulation is moving towards ever-stricter requirements for traceability and proof in professional communications. Firms that act now will gain an edge, both in protection and credibility.

What exists today to address this

Verification via a different channel

The most effective short-term recommendation remains simple: for any wire instruction, change of bank details or sensitive request received by email, verify by phone using a known number – never the one in the email. This is systematically required of French lawyers (CARPA) in real-estate transactions.

Limitation: this procedure assumes you have a doubt in the first place. The best BEC scenarios are precisely the ones that raise none.

Cryptographic certification of the sender

This is the structural answer to the problem. It involves attaching a cryptographic signature tied to the sender's identity – not just their domain – to every outgoing email. Combined with a qualified eIDAS timestamp, this signature constitutes verifiable technical proof: the email was indeed sent by this person, at this exact time, with this content.

If someone impersonates you, the fraudulent emails won't carry a valid signature. The recipient can check this. And in a dispute, you can prove you didn't send the fake email.

This is exactly what STEGA TRUST builds: cryptographic certification of professional emails, integrated directly into Outlook, with public verification available to any recipient at verify.stegatrust.com.

What you can do today

1. Check your DNS configuration. Make sure SPF, DKIM and DMARC are configured and DMARC is set to "reject", not "none". This is the baseline. If your IT provider hasn't checked this yet, ask this week.
2. Formalise a systematic callback procedure. For any bank details or wire instruction received by email, call back on a known number before acting – never the one in the email. This procedure must be written down, communicated to all staff, and applied without exception, even when the email appears to come from a trusted contact.
3. Educate your clients. Tell them explicitly that your firm will never request a change of bank details by email alone. Give them a reference number to call if in doubt. This simple message can prevent a fraud.
4. Plan ahead for certification. The question is no longer whether cryptographic email certification will become a professional standard, but when. NIS2, eIDAS 2.0 and pressure from cyber insurers all point that way. Firms that adopt it early turn it into a differentiator with their clients.

In summary

BEC isn't a technical problem reserved for large corporations. It's a real threat to any firm that sends emails carrying financial or legal weight. Conventional solutions – anti-spam, SPF/DKIM, training – aren't enough against sophisticated attacks.

The structural answer is sender certification: proving that every email really comes from you, not an impostor. That's what's missing today. And it's coming.