Business email compromise (BEC) uses social engineering, not malware—layered defenses and user vigilance are essential.