A cybercriminal running a business email compromise (BEC) attack typically avoids impersonating low-authority, low-recognition employees with no payment approval rights and no access to money or sensitive data — receptionists, junior interns, and outside parties unconnected to the transaction. Impersonation costs effort, and BEC succeeds by borrowing trust and authority; an identity that grants neither is a wasted pretext. The attacker's target is almost always someone whose name unlocks action: an executive, a finance approver, or a known vendor contact.
The keyword question sounds narrow, but it opens onto how BEC actually works. Impersonation is a tool for exploiting authority gradients and routine trust. Understanding who gets left out clarifies who gets targeted and why. It also sharpens defenses, because the same logic that tells an attacker whom to avoid tells a defender where to concentrate verification.
The mechanism: why impersonation targets authority, not anonymity
Business email compromise is a social-engineering fraud, not a technical intrusion. The attacker sends email that appears to come from a trusted party and induces a payment, credential disclosure, or data transfer. The FBI's Internet Crime Complaint Center (IC3) categorizes BEC as a confidence trick executed through email, and its annual reports show BEC consistently among the highest-loss cybercrime categories. The mechanism is pretext plus authority.
Impersonation works because employees are trained to respond to hierarchy and routine. A message from a company officer carries implied permission to act urgently. A message from a known vendor's accounts-payable contact carries implied legitimacy. The attacker does not need to hack anything if the recipient believes the sender. This is why BEC requires so little technical skill relative to its payoff: the exploit is human trust.
Who would a cybercriminal not typically impersonate? The answer follows from the mechanism. An attacker impersonates identities that carry decision authority, payment approval power, or established trust with the finance function. An identity without those attributes gives the attacker nothing to leverage. Impersonating a receptionist to ask for a wire transfer is implausible. Impersonating a controller to instruct accounts payable is routine.
There is a deeper layer. BEC often exploits the gap between how an organization verifies payment and how it verifies identity. If a vendor's email domain can be spoofed or lookalike-registered, the attacker needs the vendor's name, not the vendor's cooperation. The target identity is the payroll clerk who releases funds, or the executive who approves the invoice. The impersonated party is whatever name makes that release feel routine.
Quantified context: what BEC losses and volumes show
The scale of BEC clarifies why attacker effort concentrates where it does. IC3 reports have tracked BEC as one of the costliest categories of reported cybercrime for years, with reported losses in the billions of US dollars annually across thousands of complaints. The exact figures shift year to year, and the reports are self-selected complaints, so they understate true volume. The direction is stable: BEC pays.
A single successful wire transfer can exceed the median annual loss for many other cybercrime types. A USD 30 invoice fraud is trivial; a USD 30,000 supplier-payment redirect is a bad quarter for a small firm. The attacker's return on effort is highest when the payoff is a single large transfer, which is why executive and vendor impersonation dominate.
Consider the effort side. Spoofing a display name costs almost nothing. Registering a lookalike domain costs the price of a domain. Sending hundreds of low-quality impersonation emails is cheap, and one response justifies the batch. Against that, impersonating a name with no payment authority cannot produce a transfer because no one would act on it. The cost-benefit calculation is lopsided, and it points away from low-value identities.
The pattern extends to targeting. Threat intelligence and law enforcement advisories consistently describe BEC actors studying an organization's structure — its executives, finance staff, and vendor relationships — before sending a pretext. That reconnaissance selects for identities that sit near money or authority. An identity remote from both is reconnaissance noise.
Edge cases: when the "low-authority" rule bends
A few exceptions refine the rule. BEC does not always ask for money first. Some campaigns impersonate an executive to request a "quick favor" that harvests credentials, gift cards, or payroll changes. Gift-card BEC, where a fake executive asks a junior employee to buy cards, specifically targets employees with less authority because they are easier to pressure and less likely to challenge a senior. In that variant, the impersonated party is the executive, but the exploited employee is junior.
Payroll diversion is another edge case. The attacker impersonates an employee asking HR or payroll to change direct-deposit details. The impersonated identity has no payment authority, but it has something else: a legitimate claim on a recurring payment. This shows the governing principle is not rank but control over a money flow. Rank is only one route to money.
The most counterintuitive case involves impersonating a party no one would suspect. In invoice fraud, the attacker impersonates a vendor — a party outside the organization — to redirect payment on an existing invoice. The impersonated identity is not an insider at all. And the attack works because the vendor relationship is trusted and the payment is expected. The lesson is that "who would a criminal not impersonate" is best framed as "who has no authority, no money flow, and no trust relationship to exploit."
One professional caveat: overgeneralizing the rule breeds complacency. Sophisticated actors sometimes impersonate mid-level staff to build rapport before escalating to a higher-value pretext in the same thread. The impersonated party is a stepping stone, not the destination. Defenses should not assume that only executives and vendors are used.
Misconceptions: what BEC is not
Misconception one: BEC requires hacking. Most BEC is pure deception and leaves no malware. The attacker rents or spoofs an email identity, and the fraud is entirely social. This is why technical perimeter defenses miss it. It also explains why the impersonated identity matters more than the delivery channel.
Misconception two: only gullible people fall for it. BEC exploits norms and authority, not naivety. A finance officer who pays a real vendor on a real invoice is doing their job. The attacker's job is to make the fraudulent request indistinguishable from the routine one. Otherwise competent people fall for it precisely because they are following process.
Misconception three: the impersonated party is always a C-level executive. Vendor impersonation and employee-payroll impersonation are widespread. The attacker selects whoever controls the money flow in the specific scam, which is sometimes not senior at all.
Misconception four: the fake email address is obvious. Attackers use lookalike domains, display-name spoofing, and reply-to redirection. Common red flags include a reply-to address that differs from the visible sender, a domain with a swapped character, and unusual urgency. But absence of these flags is not proof of legitimacy.
Watch for these red-flag warning signs in any instruction to move money or credentials: Urgency that discourages verification, such as "before end of day" or "do not call, I'm in a meeting." A change to payment details on an existing invoice or vendor record. A reply-to or sender domain that differs subtly from the known contact. Requests to bypass normal approval or use an unusual payment method. A first-time or one-off request from an executive who normally routes through finance. Pressure to keep the request confidential from colleagues.
Practical actions: verification thresholds that close the gap
The defender's move mirrors the attacker's logic. If criminals impersonate whoever controls money or authority, verification must attach to the money movement itself rather than the apparent identity. Concrete thresholds make this operational.
Out-of-band verification is the core control. Any request to change payment details, release a wire, or alter payroll must be confirmed through a channel the requester did not provide. Call the known number on file, not the number in the email. For vendor banking changes, confirm with a previously verified contact at the vendor. Set a rule: no second-channel confirmation, no payment.
Establish dollar thresholds that trigger enhanced verification. A common approach is to require dual approval and call-back confirmation for any new payee or any change to existing payment instructions above a set amount, with USD 10,000 as one frequently used tier for small and mid-size organizations. The specific number matters less than applying it consistently and documenting the exception path.
Separate duties and slow down urgency. Require two people to approve changes to vendor master data, and make it socially acceptable to delay a payment for verification. Urgency is the attacker's primary lever. A policy that permits a verification pause without penalty removes the lever.
Train to the mechanism, not the checklist. Employees should understand why BEC works — authority and routine — so they recognize pretexts that no checklist fully anticipated. Simulate vendor and executive impersonation, not just phishing links. Track who reports and who acts. Report outcomes to leadership quarterly.
Limitations: what this framing cannot predict
No rule about attacker identity selection is deterministic. BEC is adaptive, and the low-authority avoidance described here reflects incentives, not constraints. A patient actor with a tailored pretext can impersonate almost anyone convincingly given enough reconnaissance. Organizations should treat impersonation-resistance as a property of process, not a list of protected names.
Loss figures from complaint-based data understate volume and vary by reporting year; they should be read as directional, not precise. Threat-intelligence descriptions of BEC tactics evolve, and specific actor behaviors can change. The stable element is the incentive: attackers follow authority, money flow, and trust. Defenses built on that incentive remain useful even as tactics shift.
Finally, no control eliminates BEC. Verification adds friction and catches most pretexts, but determined attackers test the exceptions. The goal is to make the fraudulent request more expensive and more detectable than the legitimate one.
This article is general educational information about fraud mechanics, not legal, financial, or compliance advice. It does not promise any outcome or guarantee protection from fraud. Consult a qualified professional for guidance specific to your organization's controls and obligations.