Angvlar Security Awareness
Business email compromise fundamentals
Understand how compromised business accounts are used to manipulate trusted conversations.
Why this matters
Business email compromise may use a real mailbox, genuine thread history and familiar language. Detection depends on the request and context, not only the sender address.
By the end of this lesson
- Recognise the main warning signs
- Choose a safe verification method
- Know when and how to report the situation
What to notice
- Unexpected change inside an existing thread
- Payment or bank-detail request
- New reply-to address
- Sudden secrecy or urgency
- Writing style changes
- Request to move conversation to another channel
- Mailbox rules or forwarding changed unexpectedly
What to do
- Verify sensitive changes independently
- Review full headers when appropriate
- Use payment approval controls
- Report suspected compromise quickly
- Reset credentials and review sessions if your account is affected
- Check mailbox rules and forwarding settings
Frequently asked questions
Can a real sender address still be dangerous?
Yes, if the mailbox has been compromised.
What is more important than the display name?
The context, request, full address and independent verification.
Why is fast reporting important?
It can stop payments, revoke sessions and warn others.