Introduction
Business Email Compromise (BEC) is the highest-loss email fraud category — the FBI's IC3 reports BEC losses in the billions annually. DMARC at enforcement addresses one specific BEC technique: exact-domain spoofing of executives or vendors. Other BEC variants need different controls.
Why this topic matters
BEC is on every board's risk register. Understanding which BEC variants DMARC addresses — and which it doesn't — is essential to building a complete defense.
The BEC variants and DMARC's coverage
Variant 1: Exact-domain spoofing BEC
Attacker sends "from" the CEO's exact domain. The receiving server has no policy basis to filter.
DMARC coverage: Stopped at p=reject.
Variant 2: Look-alike domain BEC
Attacker registers brandai.com instead of brand-ai.com, sets up DMARC themselves, sends BEC mail. The look-alike domain is properly authenticated; DMARC passes.
DMARC coverage: Not addressed. Brand-monitoring service required.
Variant 3: Display-name spoofing BEC
"Your CEO <[email protected]>" — the display name says CEO but the email address is the attacker's Gmail.
DMARC coverage: Not addressed. User training and email gateway flags required.
Variant 4: Compromised-account BEC
Attacker has access to a real executive account (phishing, credential reuse, etc.) and sends from it. Real authentication.
DMARC coverage: Not addressed. MFA and account security required.
What this means for leaders
DMARC addresses Variant 1 — the highest-volume, lowest-cost-to-attacker BEC type. Variants 2-4 need adjacent controls.
A complete BEC defense:
- DMARC at
p=reject— closes Variant 1. - Brand-monitoring service — closes Variant 2.
- Email gateway with display-name analysis — addresses Variant 3.
- MFA + account security — addresses Variant 4.
- User training across all variants.
Step-by-step approach
- Roll out DMARC to
p=reject. Close Variant 1. - Subscribe to brand-monitoring for look-alikes.
- Configure email gateway to flag display-name mismatches.
- Enforce MFA universally.
- Train users continuously.
Best practices
- Frame DMARC as one layer. Don't oversell.
- Maintain wire-verification protocols. Phone confirmation for any wire-related email.
- Track BEC attempts internally. Pattern recognition improves defense.
- Pair with BIMI for visible verification.
- Review at board level. BEC is a board topic.
Recommended next step
If you have neither DMARC at enforcement nor brand-monitoring, both are priority investments. Sequence by your specific risk profile.
FAQ
Is BEC mostly Variant 1?
Volume-wise yes; loss-wise the variants are roughly comparable. DMARC closes a meaningful portion.
Does DMARC help with vendor-targeting BEC?
If the spoofed vendor has DMARC at p=reject, yes. Otherwise no.
What about CEO-targeting BEC?
Same answer. CEO's domain at p=reject closes the exact-spoofing version.
How big is BEC overall?
FBI IC3 reports billions annually. Growing.
What single control has the highest BEC ROI?
Depends on starting state. DMARC + brand-monitoring + MFA is the top-3 combination.
Final thoughts
BEC is the highest-loss email fraud category, and DMARC closes one specific variant. The complete defense layers DMARC, brand-monitoring, gateway analysis, MFA, and training.
For leaders, the framing is portfolio: each control closes a specific gap. DMARC is necessary; the others are necessary too.