Business email compromise is a social-engineering attack built around trusted business communication. The attacker may impersonate an executive, supplier, payroll contact, attorney, or other person who can influence a payment or sensitive action.
Some BEC uses a lookalike domain. Some uses a compromised legitimate mailbox. The second case is especially important: SPF, DKIM and DMARC may all pass because the attacker is using the real account and infrastructure.
Defensive layers
Useful controls include strong account authentication, suspicious-login detection, payment verification procedures, mailbox-rule monitoring, domain authentication, anti-phishing controls and an easy way for users to report suspicious mail.