A controller receives an email that appears to come from the CEO: a vendor’s banking information has changed, the payment is urgent, and the request should be kept quiet. The email may use the CEO’s real name, a familiar signature, and details pulled from public sources or a previous breached mailbox. That is why business email compromise prevention cannot depend on employees spotting an obvious fake.
Business email compromise, often called BEC, is a fraud method built around trust. Attackers impersonate executives, vendors, employees, attorneys, or payroll contacts to redirect money, steal credentials, or obtain sensitive information. They do not always need malware. A convincing message and one hurried approval can be enough.
For small and mid-sized businesses, the financial impact can be severe. A fraudulent wire transfer can disrupt payroll, vendor relationships, and cash flow. In regulated industries, a compromised mailbox may also expose protected information, contract data, or client records. The most effective response combines clear payment procedures, secured email systems, and people who know exactly what to do when a request feels unusual.
Why Business Email Compromise Works
BEC succeeds because it targets normal business behavior. Employees are trained to be responsive. Finance teams process legitimate invoices quickly. Executives often send brief messages from their phones. A criminal only needs to make a fraudulent request look plausible enough to bypass ordinary caution.
The common scenarios are straightforward. An attacker may spoof an executive’s address or register a lookalike domain with one altered letter. They may compromise a vendor’s real mailbox and send changed payment instructions from a legitimate account. They may also gain access to an employee’s Microsoft 365 account, review email threads, then reply at the right moment with a request that fits the conversation.
That last scenario is particularly difficult to catch. If the message comes from a real vendor account and references an actual invoice, traditional spam filtering may not stop it. The control that matters most is the process your team follows before changing financial or sensitive account information.
Start With a Payment Verification Rule
A written verification rule is the foundation of business email compromise prevention. It should be simple enough that employees can follow it under pressure and specific enough that no one has to guess whether an exception applies.
Any request to change vendor banking details, approve a wire, update payroll direct deposit, purchase gift cards, or release sensitive information should require verification through a separate, trusted channel. That means calling a known phone number already on file, not a number listed in the email. It can also mean confirming the request through an approved vendor portal or with an established internal contact.
Email alone should never authorize a new payment destination. This rule may feel inconvenient when a vendor wants payment immediately, but the few extra minutes are far less costly than recovering a fraudulent transfer. If a vendor regularly changes account details or cannot support a verification process, treat that as a business risk worth addressing.
For higher-value payments, use separation of duties. The person who enters a payment should not be the only person who can approve it. The exact approval threshold depends on your organization, but the logic is consistent: one compromised mailbox should not be able to move money by itself.
A practical workflow often includes these four controls:
- Require out-of-band verification for every bank-account or payment-instruction change.
- Use dual approval for wires, ACH batches, and payments above a defined dollar amount.
- Maintain approved vendor contact information in your accounting system.
- Document exceptions and require leadership approval before processing them.
The goal is not to create bureaucracy around routine invoices. It is to add friction only where a criminal can redirect funds or obtain information that causes material harm.
Secure the Email Accounts Attackers Want
Process controls limit the damage of a fraudulent request. Account security reduces the chance that criminals can send one from a real mailbox.
Start with multifactor authentication for every email account, especially administrators, executives, finance staff, and users with access to payroll, billing, or client data. Passwords get reused, phished, and exposed in third-party breaches. Multifactor authentication makes a stolen password less useful, although it is not a complete answer. Attackers now use phishing pages that attempt to capture session tokens or trick users into approving a sign-in prompt.
Use phishing-resistant multifactor methods where possible, such as security keys or number matching in an authenticator app. Avoid allowing text-message codes as the only option for high-risk accounts. Text messages are better than passwords alone, but they are more vulnerable to SIM swapping and social engineering.
Email security settings also deserve regular review. Configure protections that help detect impersonation, suspicious attachments, malicious links, and unusual sender behavior. Domain protections such as SPF, DKIM, and DMARC can reduce spoofing of your own domain. They do not stop every impersonation attempt, especially messages sent from compromised external accounts, but they are a necessary baseline.
Administrative access needs tighter control than ordinary user access. Limit who can create mailbox forwarding rules, change multifactor settings, add new applications, or grant consent to third-party tools. Review privileged accounts regularly and remove access when responsibilities change. A former employee’s account or an unused administrator login is an unnecessary opening.
Watch for the Quiet Signs of Account Takeover
Many BEC incidents are not discovered when the first phishing email arrives. They are discovered after an attacker has been inside an account, reading conversations and setting up rules to hide replies or forward messages externally.
Your IT team should monitor for suspicious sign-ins, impossible travel alerts, newly created inbox rules, unfamiliar application permissions, and unusual forwarding activity. A sudden rule that moves messages containing words such as “invoice,” “wire,” or “payment” into an archive folder deserves immediate attention.
Employees should know how to report a suspicious message without worrying that they are overreacting. A fast report allows IT to check whether the email was isolated to one inbox, delivered across the organization, or connected to a compromised account. It also lets finance place a temporary hold on transactions connected to the request.
Speed matters when money is involved. If a fraudulent payment is sent, contact the financial institution immediately and ask about recall or fraud-recovery procedures. Preserve the email, headers, invoice, payment details, and related communication. Then reset affected credentials, revoke active sessions, inspect mailbox rules, and determine whether any other accounts or vendors were targeted.
Train for Decisions, Not Just Phishing Tests
Annual security training is useful, but a once-a-year slide deck will not prepare someone for a believable request from the company president. Short, recurring training works better when it reflects the situations employees actually face.
Finance personnel need examples of changed remittance instructions, false invoice follow-ups, and urgent executive requests. HR teams need examples involving direct-deposit changes and employee records. Executives and assistants should understand that their public travel schedules, social media activity, and organizational charts can be used to make fraud more convincing.
Training should also give employees permission to slow down. A message marked urgent is not automatically legitimate. A senior title is not an exception to the verification process. When leadership follows the same rules, employees are much more likely to do the same.
Phishing simulations can help identify coaching opportunities, but they should not become a gotcha exercise. The purpose is to improve reporting and decision-making, not embarrass people. Measure whether users report suspicious messages, whether reports reach IT quickly, and whether repeat patterns point to a process gap.
Make IT and Finance Accountable Together
BEC crosses departmental boundaries. Finance owns payment approval, IT manages identity and email security, and leadership establishes the expectation that controls are followed. If these functions operate separately, criminals can exploit the gaps between them.
A quarterly review is a practical time to test the process. Confirm that vendor verification contacts are current, payment thresholds still fit the business, departed employees have been removed, and email security alerts are reaching the right people. For healthcare, legal, financial, defense, and manufacturing organizations, include the compliance or risk owner in that review as well.
A managed IT partner can provide monitoring, Microsoft 365 security management, incident response support, and user training, but it cannot approve your financial controls for you. The strongest arrangement is one where IT clearly documents what it monitors and finance clearly documents what it verifies. Gravity Networks takes this practical approach with clients: defined responsibilities, local support, and regular conversations about the risks that can interrupt operations.
The next payment-change request will probably look ordinary. That is the point. Build a process that does not require anyone to make a perfect judgment under pressure, and your team will be far harder to deceive.