Business email compromise involves an attacker targeting a specific individual in the organization, often a payroll person or CEO, creating a spearfishing email, and then substituting the real email with a Unicode email that looks the same. The attacker will send a message using the appropriate language and relationships, manipulating individuals into transferring funds or sensitive information by masquerading as a trusted source.