The Property Trap: Store of Value or Income Generator: Getting the Best of Both Worlds

Digital Transformation & Innovation

Email has been used in business for decades. In fact, email has become such an integral aspect of doing business that most businesses would not function satisfactorily without it. So what exactly is Business Email Compromise (BEC)? BEC is deception via e-mail. A malicious outsider impersonates a trusted party that you deal with on a regular basis: typically a supplier, senior executive, or finance contact: and convinces an employee to transfer money or disclose sensitive information. It is a financial exposure that sits, often unquantified, on the balance sheet of every business that transacts business electronically. This then means that this risk also now sits at the boardroom. Among the various forms of cyber-enabled fraud, Business Email Compromise (BEC) is one of the most financially damaging and least understood by non-technical decision-makers. If your organisation uses email to transact business on a daily basis or confirm transactions, this article is for you. The cybersecurity risk most businesses do not quantify When we talk of risks to physical, tangible assets, most businesses in Malawi would immediately insure a physical asset against fire or theft. Very few have an equivalent understanding of their exposure to a fraudulent payment instruction received via email. This risk feels intangible, and therefore less urgent. Making that assumption is dangerous today. Business Email Compromise typically results in direct financial loss. A single fraudulent payment, transferred to an attacker-controlled account, is often irreversible once it leaves the banking system. The same operational infrastructure that lets legitimate payments move quickly also lets fraudulent ones disappear just as efficiently. Beyond the immediate financial loss, the secondary costs are substantial. These include operational disruption during the investigation, reputational damage with suppliers and clients, potential regulatory scrutiny when customer data is involved, and the cost of implementing corrective controls after the fact. The full cost of a BEC incident is therefore not the value of the fraudulent transfer alone, but the total impact across these dimensions. In the Global Cybersecurity Outlook 2026, released by the World Economic Forum, the data shows that cyber-enabled fraud, which includes BEC, payment fraud, and invoice scams, has officially gone mainstream. Strikingly, Sub-Saharan Africa leads the world in fraud exposure, with 82% of regional survey respondents reporting exposure to digital scams: surpassing even North America (79%). This data should be concerning for a Malawian business leader. How Business Email Compromise actually works BEC's effectiveness lies in its simplicity. In most documented cases, attackers do not break into systems using advanced technical methods. Instead, they study how a business communicates and insert themselves into that pattern. A typical scenario begins with the compromise of an email account belonging to a legitimate party, such as a supplier. The attacker observes ongoing conversations, including invoices, payment schedules, and approval processes. At the right moment, they intervene: often by sending a revised bank account detail for an upcoming payment. The email appears legitimate. It references real transactions, real individuals, and correct timing. The request is often framed as urgent or routine, reducing the likelihood of independent verification. The result is a payment approved and executed under false pretences. In other cases, attackers do not compromise an account but instead impersonate one. An email address that differs by a single character from a legitimate sender, is sufficient to deceive a busy finance team working under time pressure. Why Malawian businesses are particularly exposed Several structural factors increase the exposure of Malawian businesses to BEC. First, many organisations rely heavily on email as the primary channel for financial instructions, without formal verification layers. Email becomes both the communication medium and the approval mechanism, a dual role it was not designed to perform securely. Second, internal control environments in smaller and mid-sized businesses are often informal. Payment approval processes may rely on trust rather than documented procedures, particularly where long-standing supplier relationships exist. Third, the increasing digitisation of financial transactions: mobile payments, online banking, and electronic invoicing: means that larger volumes of value move through digital channels. As the volume increases, so does the attack surface. Finally, there remains a persistent assumption that cybercriminals focus on larger, more developed markets. In practice, attackers target processes, not geography. A business with predictable payment cycles and limited verification controls presents an attractive opportunity regardless of location. What a business leader should do about the risk of BEC To satisfactorily mitigate against cyber-enabled fraud, which includes BEC, payment fraud, and invoice scams, a business should consider implementing the following controls: Conduct a comprehensive cyber fraud risk assessment of the business. This process will inform the Board of the cyber security posture of the organisation. Doing so will then inform the appropriate mitigation measures that will be chosen against this risk and the correct spend, for those controls. Controls applied will vary depending on the business sector, and quantified risk exposure, and regulatory requirements. No payment instruction that involves a change in bank details should be acted upon without independent verification. This verification must occur through a separate communication channel: typically a known telephone number: not by replying to the original email. Supplier onboarding and management processes should include verification of banking details at the point of entry, with any subsequent changes treated as high-risk events requiring elevated scrutiny. Businesses should implement a clear segregation of duties within the payment process. The individual who receives an invoice should not be the same person who authorises the payment and executes it. Even in small organisations, introducing a second point of review creates friction that attackers rely on avoiding. Conduct regular cybersecurity awareness for all users within the organisation. This will ensure that all staff are aware of the risks of cyber-enabled fraud and the required controls. Conducting these trainings regularly will ensure that staff are consistently reminded to stay vigilant against these sort of risks. Roll out enhanced email security tools that match the risk exposure informed by the assessment conducted as the first remediation. Such tools may include an email security gateway solution, enabling multi-factor authentication on all business email accounts, and monitoring for unusual login activity. Malawian organisations are increasingly reliant on interconnected digital service providers and external vendors. Fraudsters exploit these relationships by intercepting vendor emails to push fake invoices or alter payment details, turning this trust relationship into a weapon. For this reason, and considering the rising risk exposure around this aspect of doing business, it is incumbent on business leaders to begin treating BEC as a financial risk. Practically, this means incorporating it into risk registers, considering appropriate insurance where available, and reporting on it at the same level as other operational risks. Implementing these simple measures will ensure that the organisation stays aware of this risk exposure and takes adequate measures to protect against it materialising.

Insurance & Risk Management

Expert commentary on emerging risks, resilience, risk mitigation strategies, and protecting businesses and individuals in a changing world. Full article content for this Insurance & Risk Management feature is coming soon. Check back for perspectives from across the NICO Group on how organisations and individuals can strengthen resilience in an evolving risk landscape.