Business Email Compromise in the UAE: How Invoice Fraud Works and How to Stop It

Business email compromise, often called BEC or invoice fraud, is one of the most costly cyber threats facing UAE businesses. It rarely involves clever hacking. Instead, criminals get into a mailbox or impersonate one, then persuade someone to pay a real-looking invoice into the wrong bank account. By the time anyone notices, the money has usually moved on.

How a typical attack works

1. Getting in. A staff member receives a convincing phishing email, often a fake Microsoft 365 login page, and enters their password. Without multi-factor authentication, the attacker now has their mailbox.
2. Watching quietly. The attacker reads emails for days or weeks to learn who pays whom, how invoices look and when payments are due. They often create hidden inbox rules so replies from suppliers or the finance team are moved out of sight.
3. The switch. At the right moment, the attacker sends an email from the real mailbox, or from a lookalike domain, saying the supplier’s bank details have changed. The invoice is genuine; only the account number is not.
4. The payment. Finance pays the “updated” account. The real supplier chases payment weeks later, and the fraud is discovered.

Warning signs

• A request to change bank details, especially with urgency or a reason to avoid a phone call
• A sender domain that is one character different from the real one
• Replies that seem to go missing, or colleagues who say they never received an email you sent
• Unexpected sign-in alerts or password reset emails

How to protect your business

Technical controls

• Multi-factor authentication for everyone. This stops the large majority of mailbox takeovers.
• Block automatic forwarding to external addresses and alert on new inbox rules.
• SPF, DKIM and DMARC on your domains, so criminals cannot easily send email that appears to come from you.
• Advanced email filtering, such as Microsoft Defender for Office 365, to catch phishing links and lookalike domains.
• Sign-in monitoring for logins from unusual countries or impossible travel.

Process controls

• Call to verify any bank detail change using a phone number you already hold, never one in the email.
• Two-person approval for new payees and large or unusual payments.
• Regular, short training so staff recognise phishing and know it is fine to question an urgent request, even from a director.

If it happens to you

Act fast. Contact your bank immediately to try to stop or recall the transfer, and report the incident to the police. In Dubai, Dubai Police’s eCrime service handles online fraud reports. Then reset the affected passwords, remove any suspicious inbox rules and sessions, check which other accounts were accessed, and warn suppliers and clients who may receive fraudulent emails from you.

How Tech1UAE can help

Our cybersecurity team can check your Microsoft 365 tenant for the gaps BEC attackers use, set up the controls above and train your staff. Our managed security services then monitor sign-ins and mailboxes so suspicious activity is caught early. For a full list of settings, see our Microsoft 365 security checklist for UAE businesses.