Over twelve months, we ran a business email compromise campaign against a client’s support desk. We built lookalike domains and manufactured a fake authority figure to sign off on every request. No zero-days, no brute force, just psychology, patience, and an inbox. When we finally asked for the data, the client handed it over politely.
This is social engineering at its finest.
No sophisticated exploits, no malware.
Just AI social engineering, a lookalike domain, and the words: “This is approved. Please go ahead.”
The research
The brief was clear: use AI social engineering to trigger a business email compromise, and see if we could extract private customer data through official communication channels.
We started by feeding an AI chatbot publicly available information about the client and their customer base. The goal: identify high-value targets worth impersonating.
The AI generated two lists:
- Top 5 customers by revenue
- Top 5 customers by relationship length
We selected a customer that scored high on both. A valuable, trusted, long-standing relationship. The kind of customer whose requests don’t get questioned.
Then we went deeper. Using AI and LinkedIn reconnaissance, we:
- Identified which roles typically request this type of information
- Selected two specific employees to impersonate
- Built personas with enough detail to sound legitimate
Employee #1: a public advocate for our client, senior enough to approve requests.
Employee #2: the person actually requesting the data.
The setup was theatre, but the kind that works.
The business email compromise
Here’s the catch: we didn’t just send emails from Gmail and hope for the best.
We acquired lookalike domains mimicking the customer’s official domain. Close enough to pass a quick glance. Different enough to stay legal.
Then we built legitimacy:
- Valid MX mail records pointing to Outlook mailboxes
- HTTP redirect rules sending traffic to the official domain (making it look like the domain just “redirected”)
- All links in our emails pointed to our spoofed domain
To anyone checking, it looked real. Professional. Trustworthy.
We used AI to craft the initial pretext and every message that followed. The tone had to be perfect: formal, professional, slightly cold. The kind of email you get from a customer relationship manager who’s busy and expects things to get done.
The long game
The first email went out. A polite request to collate specific information stored in the client’s system.
Then came the key move: we CC’d Employee #1, our authority figure, on the thread. Shortly after the request went out, they responded:
“This is approved. Please go ahead.”
Internal approval. No pushback. The support team started working on it.
We had no idea what data was actually stored in their database, so when they asked for clarification on specifics, we just agreed with their suggestions. They told us what they could include. We said yes to all of it.
This went on for months. Back and forth. Rapport building. AI social engineering doing what it does best: refining our tone to sound professional, urgent, and legitimate.
Fast forward to this year. A message arrived:
“The collated information is now available on the platform. You can log in and download it.”
Perfect. Except for one small problem.
“Unfortunately, we don’t have access to the system at the moment. Could you send us the data via [third-party file sharing service they use]?”
Our authority figure chimed in again. Same energy. Same trust-building magic:
“This is approved. Please go ahead.”
And they did.
A message arrived containing a link to download the sensitive data we’d requested. No authentication. No verification call. Not even a “let us confirm this with your team first.”
Just a file-sharing link with everything we asked for, handed over because we couldn’t be bothered to log in.
The uncomfortable reality
So what happens when authority and convenience outrun verification? This attack worked because of three failures:
- Trust without verification. A legitimate-looking email domain was enough. Nobody called. Nobody verified through a secondary channel. The domain looked right, so the request must be real.
- Authority bias. When someone senior says “this is approved,” people stop questioning. Full stop. Even when that senior person is a stranger on the internet with a lookalike email address.
- Convenience over security. When we said we couldn’t log in, they didn’t push back or suggest alternative secure methods. Instead, they made it easier for us and sent the data directly.
Business email compromise works precisely because it exploits trust, not technology. The result? A year-long campaign with multiple emails. Sensitive customer data. And the only verification was whether the email domain looked legitimate.
The consequence is real: this class of data can trigger breach-notification duties, expose the actual customer to fraud, and damage the relationship the impersonation was built to exploit.
The wake-up call
The discovery stunned the client’s security team, not because the attack was sophisticated, but because it was so simple.
To their credit, they’ve since implemented mandatory verification protocols for any data request, regardless of who it appears to come from, exactly the kind of control that stops a BEC attack in its tracks. Phone verification with known contacts. Multi-channel confirmation for sensitive data. And training for support teams on authority bias and social engineering red flags.
As their Security Lead put it: “We trusted the domain. We trusted the authority. We never thought to verify the human. That’s exactly what attackers count on.”
Here, AI social engineering didn’t just save us time. It made every message more convincing, more patient, and harder to distinguish from a legitimate request.
If your verification process stops at “does the email look right,” you’re not verifying anything. You’re just hoping the person on the other end is who they say they are.
CovertSwarm’s social engineering testing doesn’t just test your technical controls. We test your people, your processes, and your ability to catch a business email compromise before it becomes a breach.
The next person asking for sensitive data might sound professional, legitimate, and patient.
Just like we did.
Ready to see where your defences break?
Contact CovertSwarm and let us show you what attackers see.