How to Prevent Business Email Compromise

To prevent business email compromise, require an independent check before changing payment details, protect mailboxes with multi-factor authentication, and watch for rules or logins your staff did not create. A convincing message may come from a lookalike domain or a real account an attacker has taken over. Your team needs one simple rule: a new bank account, urgent wire, gift-card request, or change in supplier instructions is verified through a known phone number or another established channel before money moves.

What does a business email compromise attempt look like?

The message often appears to come from an executive, supplier, client, or closing agent and asks for an urgent payment or change in process. It may use a familiar conversation thread if a mailbox has been compromised. The FBI describes requests that seem legitimate because the sender appears to be someone the business already knows. Train your staff to pause when the request changes bank details, asks for secrecy, or pressures them to skip the normal approval path.

The FBI explains common business email compromise patterns and what to do if you are targeted.

How should you verify a payment change?

Call the supplier or colleague using a number already in your records, not the number in the new email. For a bank-account change, have a second person approve the update and keep the confirmation with the payment record. A phone call to the known contact is a small delay compared with recovering a wire sent to the wrong account. Set this rule before a crisis so a convincing urgent request cannot override it.

Which email and account controls matter most?

Put MFA on mailboxes and administrator accounts, remove shared mailboxes as login identities where possible, and review forwarding rules and app access. Configure SPF, DKIM, and DMARC for your domains to make simple spoofing harder, while understanding that those checks do not stop an attacker using a genuinely compromised mailbox. Use email filtering and sign-in alerts as supporting controls. Give finance and leadership accounts extra attention because they can authorize payments or sensitive data changes.

How do you train staff without relying on fear?

Give staff a short checklist they can use at the moment of a request: did the payment details change, is the request outside normal timing, does the sender ask for secrecy, and has anyone confirmed it through a known channel? Make it easy to report a suspicious message without blame. Practice with realistic examples from your own workflows, such as vendor invoices and property closings, and measure whether staff report the request before acting.

What should you do if money or an account is already affected?

Contact your bank immediately and ask about a recall or hold. Preserve the message and transaction details. Secure the affected account, revoke sessions, reset credentials, and check mailbox rules and recent access. Follow your incident response process and report the fraud to the appropriate authorities. The Australian Cyber Security Centre also recommends contacting the bank promptly and using independent channels to verify requests. Speed matters, so make the escalation phone numbers easy for your team to find.

The Australian Cyber Security Centre explains how to verify payment requests and protect against business email compromise.

What should a payment-change approval process say?

Write the rule as a short sequence a busy employee can follow: pause the payment, look up the supplier in the approved records, call the known contact, record who confirmed the new details, and require a second authorized person to approve the change. Do not rely on replying to the email or calling a number supplied in that same thread. Keep the old payment details until verification is complete. Apply the rule to urgent requests from executives as well as suppliers; an attacker often uses seniority and deadlines to make a normal check feel optional.

How do spoofed and compromised accounts change the response?

A lookalike domain or forged display name may be caught by careful address checks and domain authentication. A message sent from a real but compromised mailbox can pass those checks and sit inside an existing conversation. Treat an unexpected change of bank details or secrecy request as a process exception even when the sender address looks correct. If your own mailbox is compromised, preserve sign-in and mailbox audit records, revoke sessions, inspect forwarding and inbox rules, and notify affected contacts through a trusted channel. Technical filtering and payment approval work together because neither covers every version of the scam.

Which everyday workflows need a rehearsal?

Choose the workflows where an email can move money or data: vendor invoices, payroll changes, property closings, and requests for tax or customer records. Walk the team through a realistic change request and see whether they use the approved contact list, the second approval, and a report button or escalation number. Make the exercise specific to who can edit banking records and who releases payments. A generic phishing quiz may teach staff to spot a strange link, but business email compromise can contain no link at all.

What should happen in the first hour after a suspected payment fraud?

The person who spots the problem should call the bank immediately using a trusted number and ask what recall or hold options are available. Assign someone else to preserve the full email, payment record, and timeline while IT secures any affected account. Tell the incident lead and finance owner so no related payment is sent during the investigation. Follow the bank's and law enforcement's reporting directions; the FBI also points US victims to its Internet Crime Complaint Center. Record who was contacted and when. Do not wait for a complete technical investigation before contacting the bank, because the opportunity to recover funds can narrow quickly.

How do you make verification possible before an urgent request arrives?

At supplier onboarding, record a verified phone number and the people authorized to approve banking changes. Keep that information in the supplier record rather than only in an email thread. Decide who can edit the record, who can approve a change, and who can release a payment; those roles should not silently collapse into one person's inbox. For an existing supplier, verify the contact through a known contract, previous transaction, or established phone call before treating a new number as trusted. This preparation is what lets an employee perform a genuine independent check when a plausible Friday-afternoon invoice arrives.

What should IT monitor around high-risk mailboxes?

Finance, executive, and administrator mailboxes warrant attention to unfamiliar sign-ins, newly added forwarding rules, unexpected app permissions, changes to MFA methods, and unusual message-sending patterns. Decide which alerts are acted on immediately and who receives them when the primary administrator is away. Review access that former employees, vendors, or unused apps still have. Keep a route for finance staff to report a suspicious payment request directly to IT and the finance lead without forwarding it around casually. Monitoring cannot approve a payment for you, but it can shorten the time a compromised account remains useful to an attacker.

See common phishing email examples your staff can practice spotting.

See how managed email security protects your business.