Email impersonation & BEC: how attackers send mail as you
Business email compromise (BEC) is among the costliest cybercrimes, and it almost always starts with a message that looks like it came from a trusted party. Understanding the two kinds of impersonation tells you exactly which one you can shut down today.
What BEC actually is
Business email compromise is a targeted scam: an attacker poses as someone trusted — a CEO, a supplier, the finance team — to trick a person into wiring money, changing payment details, or handing over data. There's usually no malware to catch. The whole attack rides on a single thing: a message that looks like it came from the right person.
The two kinds of impersonation
1. Exact-domain spoofing
The From address is your real domain — cfo@yourcompany.com — forged outright. It's the most convincing attack because it isn't an imitation; it's literally your domain. This is the one you can shut down.
2. Lookalike (cousin) domains and display-name tricks
The attacker registers a similar domain (yourcompany-billing.com) or just sets the display name to your CEO while sending from a random address. These don't use your domain at all, so your DNS records can't block them directly.
What authentication stops — and what it doesn't
DMARC at enforcement stops exact-domain spoofing cold: a forged message claiming to be your domain fails authentication and is rejected before it reaches anyone. That removes the single most believable attack in the BEC playbook.
It does not stop lookalike domains or display-name spoofing — those need user training, mail-filtering rules, and sometimes defensively registering close variants. But closing the exact-domain hole means an attacker can no longer be you; at best they can only resemble you, which is far easier for people and filters to catch.
What to do
- Get your real domain to DMARC reject — and set
sp=rejectso subdomains can't be used instead. - Cover parked and non-sending domains too; attackers love a forgotten domain with no DMARC.
- Layer on filtering for lookalikes and display-name spoofing, plus finance-process controls (verify bank changes out-of-band).
Authentication is the half of the problem you can fully control, so it's the half to close first.
Frequently asked questions
Does DMARC stop all email impersonation?
No, but it stops the most dangerous kind. DMARC at enforcement blocks exact-domain spoofing — mail forged to come from your real domain. It does not stop lookalike domains or display-name tricks, which need other controls. Closing exact-domain spoofing removes the most convincing attack.
What's the difference between spoofing and a lookalike domain?
Exact-domain spoofing forges your real domain in the From address — it's the most convincing because it is literally your domain. A lookalike (or cousin) domain uses a similar-but-different name (yourcompany-invoices.com), which DMARC on your real domain can't control. They're defended differently.
How does BEC usually start?
Often with reconnaissance and a spoofed or lookalike email that impersonates an executive, supplier or finance contact — requesting a wire transfer, a change of bank details, or sensitive data. Because the message passes a casual 'looks legit' check, it bypasses people's instincts.
Close the exact-domain attack first
StopForge's free exposure scan reads your live records and shows exactly where your email authentication stands — what passes, what silently fails, and whether anyone can still send as your domain. No changes to your mail, no obligation.
See if your domain can be spoofedRelated guides: Can someone send email as your domain? How to check. · DMARC p=none vs p=reject: which policy actually protects you?