Human-Centric Failures: Why BEC Continues to Work Despite MFA

Why It Matters

BEC attacks cost billions because they exploit the weakest link—people—rendering pure technology solutions like MFA insufficient. Strengthening verification processes directly reduces financial loss risk and protects corporate reputation.

Key Takeaways

• Toyota Boshoku lost $30M in 2019 BEC scam
• Arup paid $25M after deepfake voice impersonation
• MFA cannot stop BEC that exploits decision‑point trust
• Process redesign with out‑of‑band verification thwarts high‑value fraud
• Simulated BEC exercises reveal workflow gaps and improve controls

Pulse Analysis

The rise of business email compromise underscores a shift from credential theft to pure social engineering. While MFA dramatically lowers the odds of account takeover, attackers now focus on the moment a payment request lands in an inbox, leveraging urgency, perceived authority, and deep‑fake technology. This tactic sidesteps authentication entirely, turning the decision point into the new attack surface. As the frequency of AITM phishing kits that can intercept MFA tokens grows, organizations must recognize that technical controls alone no longer constitute a complete defense.

Effective mitigation starts with process hardening. Finance and procurement teams should embed multi‑step verification for any high‑value or atypical transaction—mandatory out‑of‑band calls, independent contact confirmation, and automated anomaly alerts tied to vendor history. By introducing purposeful friction, such as mandatory pauses for large transfers, companies create a window for scrutiny without crippling productivity. Governance structures that assign clear BEC ownership to finance risk committees ensure that verification becomes a measurable security metric rather than an ad‑hoc courtesy.

Finally, realistic BEC simulations are essential for cultural change. Unlike generic phishing tests, these exercises replicate urgent executive requests, vendor banking changes, and deep‑fake cues, allowing leaders to observe real‑time decision making under pressure. The insights gathered help refine approval thresholds, train staff on micro‑learning cues, and normalize escalation as a protective behavior. In an era where attackers weaponize human trust, aligning people, processes, and technology is the only way to keep BEC losses in check.