What are BEC, Smishing and Vishing?
Business email compromise, smishing and vishing, told as a story about a letter in the king's handwriting that tells the clerk to send gold.
A letter in the king's handwriting reaches the clerk. "Urgent — send gold to the merchant."It's a fake letter, but there's no bug and no link. Just words. So bug cards and post office stamps mostly miss it.
Fake letters have cousins. They come as pigeon notes, and as voices.The pigeon note is a text message; the voice is a phone call. These days a parrot can copy the king's voice exactly. All three fool people, not walls.
The letter in the king's hand fools with words, not bugs. The habits never change — urgent, secret, not the usual road.Someone important, right now, tell no one, and a new place to send the gold. When these four arrive together, it is almost always the thief.
Before sending gold, ask back by another road. And the gold chest takes two people to open.Call the number you already know, not the one in the letter — or walk over and ask. And gold needs two people to sign off, so no one can send it alone — one fooled, it still stays.
The post office stamp filters letters; thief class protects people.The post office stamp filters letters from unknown senders. Some still get through, so everyone learns the habits in thief class.
BEC = a bug-free fake letter that plays the king (the boss) and tells the clerk: urgent, tell no one, send the gold to a new address. Smishing is the cousin that comes as a pigeon note (text); vishing, as a voice (phone). The defense: ask back by another road, and two people to sign off.
Email fraud that impersonates executives or vendors to trigger wire transfers or bank-detail changes. It often uses social engineering alone — no attachment, no link — so filters miss it, and it also arrives by SMS (smishing) and phone (vishing). Callback verification and dual approval are the core defenses.
When grown-ups say it
- BEC
- The letter in the king's hand. Fools with words alone — no bug, no link. → a cousin of the letter that pretends to be the post office
- Smishing
- The pigeon note. A short note (a text) saying tap here. Parcels, fines and prizes are the usual bait.
- Vishing
- The letter that comes as a voice. Plays the king over the phone. → the parrot that copies the king's voice
- CEO fraud
- Playing the king. In an important name: right now, tell no one. Hard for the clerk to question.
- Invoice / payment fraud
- Not the usual road. The merchant has a new address — and the gold lands in the thief's chest.
- Callback verification
- Asking back by another road. Call the number you already know — never the one in the letter.
- Dual approval
- Two people to open it. Two locks on the gold chest. → only the keys you need
- Email authentication
- The post office stamp. Stamps that prove who really sent it. → three post office stamps