How to Prevent Business Email Compromise

01How a BEC scam works

1. 01

   Access or impersonation

   The attacker phishes the password to a real mailbox, or registers a lookalike domain one letter off from yours or a vendor’s.

2. 02

   Quiet observation

   With access, they read mail for days or weeks, learning who approves payments, which invoices are due and how people write.

3. 03

   Hiding the trail

   They create inbox rules that move or delete replies, so the real person never sees the conversation happening in their name.

4. 04

   The request

   At the right moment they send a convincing message: new bank details for a vendor, an urgent wire for a closing or a change to someone’s direct deposit.

02The common variants

• Vendor invoice fraud: a real or spoofed supplier asks you to pay a new account
• CEO fraud: the “owner” asks finance for an urgent, confidential wire or gift cards
• Payroll diversion: an “employee” asks HR to change their direct deposit
• Closing fraud: wiring instructions changed just before a real estate closing
• Data theft: a request for W-2s or client records, used for later fraud

In the FBI’s Internet Crime Complaint Center reports, losses from business email compromise have consistently far exceeded those reported for ransomware, which is why insurers and banks now ask how payments are verified.

03Process controls that stop it

Technology lowers the odds, but a written payment process is what stops the loss. The rule we recommend to every client is simple: no change to payment details is ever accepted on the strength of an email alone.

• Verify new or changed bank details by calling a number already on file, never one from the email
• Require two people to approve new payees and any wire above a set threshold
• Treat urgency and secrecy as red flags, not as reasons to skip steps
• Confirm direct deposit changes in person or through the HR system, not by email
• Tell vendors and clients how you will, and will not, ever ask for payment

04Technical controls

• MFA on every mailbox, with legacy sign-in methods turned off
• SPF, DKIM and DMARC on your domain, with DMARC moved toward enforcement so others cannot send as you
• Alerts on inbox rules that forward, move or delete mail, a classic sign of a compromised account
• Sign-in monitoring for unfamiliar locations and impossible travel
• External sender tags and lookalike domain detection in email filtering
• Training and simulations built around invoice and payroll requests, not just fake password resets

05If money was sent

1. 01

   Call your bank

   Ask for a recall of the wire or ACH and for the receiving bank to be contacted. Speed matters more than anything else here.

2. 02

   Report it

   File a complaint at ic3.gov with the transaction details. Prompt reports help law enforcement work with banks to freeze funds.

3. 03

   Secure the account

   Reset the password, revoke sessions, remove unknown inbox rules, forwarding and MFA methods.

4. 04

   Find the scope

   Review what the attacker could read and who else they emailed. Clients and vendors may need a warning.

5. 05

   Notify your insurer

   Contact your cyber insurance carrier early, since many policies require prompt notice and approved vendors.

06How we help

BEC sits where email security and business process meet, so we work on both. Microsoft 365 spam and phishing filtering, security awareness training and phishing simulation come with every supported user, and our Microsoft 365 administration covers MFA, conditional access and mail flow. Through vCIO planning we help you write down the payment verification steps your bank and insurer are likely to ask about.

How managed Microsoft 365 works