Business Email Compromise (BEC) attacks have overtaken ransomware as the dominant financial cyber threat to UK businesses
in 2026. Unlike ransomware—which announces itself loudly and forces an immediate response—
BEC is silent, surgical, and frequently goes undetected for weeks before the loss is realised
. For Kent SMEs, this represents a critical shift in the threat landscape that demands immediate attention.
UK B2B BEC losses now run into hundreds of millions per year by Action Fraud’s estimates, with average individual losses of £25,000–£120,000 for SMBs
. Globally,
the FBI’s Internet Crime Complaint Center reported that BEC alone accounted for 24,768 complaints and $3.047 billion in reported losses in 2025
, and
the average loss per BEC incident now stands at $137,000
—an 83% increase since 2019. Most concerning for UK businesses:
the majority of 2024 cyber insurance claims (60%) originated from business email compromise and funds transfer fraud incidents
.
Why Business Email Compromise Is the Silent Killer for UK SMEs
According to recent insights from Microsoft’s Digital Crimes Unit, BEC accounts for nearly half of all cybercrime losses globally
. The reason is simple:
BEC attacks rely on deception, social engineering and a single convincing email to trick employees into transferring money or sensitive data. There is often no malware to detect and no malicious link to block
, which is precisely what makes this threat so dangerous.
Traditional security tools struggle with BEC because
modern Business Email Compromise is highly targeted, text-based, and often contains zero malicious payloads. In 2026, attackers use AI and LLMs to generate polymorphic, grammatically perfect emails that bypass traditional filters by mimicking the exact communication style of executives or vendors
. The days of spotting phishing emails by poor grammar and spelling errors are over.
The Five Most Common BEC Attack Patterns Hitting Kent Businesses
Understanding how BEC attacks work is the first step to stopping them. Here are the five variants most frequently targeting UK SMEs:
1. CEO Fraud (Executive Impersonation)
An email appearing to come from a senior leader asks a finance team member to make an urgent, confidential payment. The urgency and the apparent authority are designed to bypass normal checks
. The attacker relies on employees’ reluctance to question instructions from the boss, especially when marked as time-sensitive.
2. Invoice and Supplier Payment Fraud
A seemingly legitimate invoice arrives from a known supplier, but the bank details have been altered. The payment goes directly to the attacker’s account. This is particularly effective because the invoice itself may be genuine—only the payment details have been changed.
3. Account Compromise (Mailbox Takeover)
The attacker gains access to a real internal or supplier mailbox, often through a phished password, and sends requests from a genuine address. These are the hardest to spot because nothing about the sender looks wrong
. The email truly comes from a trusted domain, passing all technical security checks.
4. Vendor Email Compromise (VEC)
The attacker takes over a real supplier’s mailbox and uses it to send legitimate-looking but fraudulent invoices to the supplier’s actual customers. Because the email truly comes from the supplier’s real domain (no spoofing), every email-security check passes. VEC is the leading cause of supplier-payment fraud in UK B2B in 2026
and the most difficult variant to detect through technology alone.
5. Payroll Diversion
A message impersonating an employee asks HR or payroll to update bank details, redirecting salary to the attacker
. This often succeeds because it appears to be a routine administrative request.
Real-World Impact: The £700,000 Payment That Disappeared
In April 2026 a hacker stole £700,000 from a UK energy company by redirecting a single supplier payment
. The attacker compromised the email chain, altered bank details on a legitimate invoice, and the money vanished before anyone realised what had happened. This wasn’t a sophisticated technical breach—it was a well-executed social engineering attack that exploited gaps in payment verification procedures.
Stories like this are becoming increasingly common.
One of the most challenging aspects of BEC is that it’s often months before the target realizes they’ve been a victim of fraud
, by which time recovery is nearly impossible.
What Kent SMEs Must Do Now to Stop BEC Attacks
Defending against BEC requires a combination of technical controls and procedural safeguards. No single technology will solve this problem—you need a layered approach:
Technical Controls
- Enforce multi-factor authentication (MFA) on all email accounts:
Implementing MFA across accounts limits the risk of email account compromise – a common first step in BEC
. This single measure blocks the majority of credential-theft attacks. If you haven’t already switched from SMS-based MFA to more secure methods, read our guide on why Microsoft retired SMS and voice call MFA in August 2026. - Implement email authentication protocols (SPF, DKIM, DMARC): These technical standards help prevent domain spoofing by verifying that incoming emails genuinely come from the domains they claim to represent.
- Deploy advanced email filtering: Modern email security tools can detect anomalies in sender behaviour, flagging emails from compromised accounts or lookalike domains. However, don’t rely on filters alone—
legacy SEGs are built on pattern matching and look for known bad signatures. Because AI-generated BEC attacks are unique and lack a historical signature, they easily bypass pattern-matching tools
. - Monitor for suspicious inbox rules: Attackers often create hidden forwarding rules to monitor email traffic. Regular audits of mailbox rules can reveal compromised accounts.
Procedural Controls (The Human Firewall)
- Verify all payment changes via a secondary channel:
Verify any changes to supplier payment details via a secondary channel. Use different communication channels for financial approvals
. If you receive an email requesting a bank detail change, phone the supplier using a number from your existing records—never use contact details provided in the email itself. - Require dual authorisation for payments above a threshold: No single employee should be able to authorise large payments without a second approval. This simple control stops most CEO fraud attacks.
- Train staff to recognise BEC tactics: Your finance and HR teams need specific training on BEC patterns. Unlike generic phishing awareness, BEC training should focus on the social engineering tactics attackers use to create urgency and bypass normal procedures.
- Implement a clear escalation procedure: Staff must know how to report suspicious payment requests without fear of “bothering” senior management. The culture must support verification, not discourage it.
- Review and audit vendor communications regularly: Periodic checks of supplier email correspondence can reveal signs of compromise before a fraudulent payment is made.
Response and Recovery Planning
Even with strong controls, you need a documented response plan for when (not if) a BEC attempt occurs:
- Know how to freeze or reverse payments: Contact your bank immediately if you suspect fraud. Speed is critical—recovery is only possible if you act within hours, not days.
- Report to Action Fraud: UK businesses should report BEC incidents to Action Fraud to support law enforcement investigations.
- Notify your cyber insurer: If you have cyber insurance, check your policy’s notification requirements. Many policies require prompt reporting of suspected fraud. Our recent article on the seven technical controls UK insurers now demand from SMEs covers what insurers expect to see in place.
- Review how the attack succeeded: Every incident is an opportunity to strengthen your defences. Identify the gaps that allowed the attack and close them.
How BEC Connects to Broader Fraud Trends in 2026
Business Email Compromise doesn’t exist in isolation. It’s part of a broader trend where fraud and cyber security have become the same risk for UK SMEs. The UK Government’s Fraud Strategy 2026-2029 recognises this convergence, with
the strategy aiming to strengthen the ability of individuals and businesses to detect and prevent fraud before harm occurs, including expanding awareness campaigns targeting small organisations
.
The patching discipline we’ve been emphasising in recent weeks—including Microsoft’s new recommendation to deploy Windows updates within three days—also applies to BEC defence. Keeping email systems patched and up to date reduces the attack surface that allows credential theft in the first place.
The Bottom Line for Kent SMEs
Business Email Compromise has overtaken ransomware as the primary financial cyber threat because it’s silent, surgical, and exploits human trust rather than technical vulnerabilities. A single successful BEC attack can cost your business tens or hundreds of thousands of pounds—often more than your annual IT budget.
The good news is that BEC is preventable. The combination of MFA, email authentication, payment verification procedures, and staff awareness creates a defence-in-depth approach that stops the vast majority of attacks. But you must implement these controls now, before you become another statistic in Action Fraud’s reports.
Need help implementing BEC defences for your Kent business? Meridian Micro can assess your current email security posture, implement technical controls including MFA and email authentication, train your staff on BEC recognition, and help you design verification procedures that fit your business workflows. Call us on 01303 883111 to discuss how we can protect your business from this growing threat.