BEC attacks typically occur when attackers gain access to an employee's email account and use it to send fraudulent emails to other employees or customers.