Many attacks need malware. Business email compromise, often shortened to BEC, needs only a convincing message. The attacker persuades someone with payment authority to send money to the wrong account or to hand over sensitive data. There is nothing to detect on an endpoint, because nothing technical was broken. A person was persuaded.

That is also why the best defense is procedural. You need rules that work even when the email looks perfect.

How These Scams Work

BEC comes in several forms, and recognizing the patterns helps:

• Fake executive request. A message appearing to come from a senior leader asks finance to make an urgent, confidential transfer.
• Vendor bank-detail change. A supplier “notifies” you that their bank account has changed. The next invoice goes to the attacker.
• Compromised real account. The attacker has actually gained access to a genuine mailbox, such as a vendor’s, and writes from it. This one is the hardest to spot, because the sender address is real.
• Invoice interception. The attacker watches a mailbox, then slips in a doctored invoice at the right moment in a real conversation.
• Payroll diversion. A message pretending to be an employee asks HR to change direct deposit details.
• Data requests. Someone posing as an executive requests employee tax records or customer lists.

The common ingredients: authority, urgency, secrecy, and a request that bypasses normal channels.

Warning Signs Worth Training On

No single sign is proof, but a cluster should slow things down:

• Pressure to act immediately or to avoid telling colleagues
• A change to bank details or payment method
• A sender address that is almost, but not quite, right
• A “reply-to” address different from the sender
• Tone that is slightly off, or phrasing unusual for that person
• An out-of-office or travel excuse for why the sender can’t be phoned
• A request that skips the usual approval steps

Warning signs fade as attackers improve, so don’t rely on spotting flaws. Rely on verification.

The Control That Works: Out-of-Band Verification

Out-of-band means confirming a request through a different channel from the one it arrived on, using contact details you already hold, not the ones in the message.

If an invoice arrives with new bank details, you call the supplier using the number in your own records, not the number in the email. If an executive requests a transfer by message, you confirm with them using a known number or in person.

Write this down as a rule with no exceptions for seniority. The strongest protection against a fake executive is that the real executive agreed to be verified.

Build a Payment Control Table

Scenario	Required control
New vendor setup	Verify identity independently; second person approves
Change to existing bank details	Call-back to known number; hold payment until confirmed
Large or unusual transfer	Dual approval by people who each verify
Urgent request from leadership	Confirm by phone or in person using stored contact
Payroll detail change	Verify with employee in person or by known number
Request for employee or customer data	Confirm legitimacy and need through a second channel

Set the thresholds for “large” with your finance lead. I’d rather you pick them deliberately than copy a number from elsewhere.

A Hypothetical Example

A bookkeeper receives an email, apparently from a regular supplier, announcing new bank details with an invoice attached. It looks right, the thread continues an earlier conversation, and payment is due this week.

Under the company’s rule, bank-detail changes trigger a call-back. The bookkeeper phones the supplier’s accounts contact using the number from the original contract. The supplier knows nothing about a change. The bookkeeper reports the email, the administrator checks whether the supplier’s mailbox might be compromised, and the vendor is told to check theirs.

The payment never moves, and the cost of the whole procedure was ten minutes.

Technical Layers to Add

Procedure comes first, but technology reduces how often bad messages arrive:

• MFA on all email accounts, which blocks many account takeovers.
• Email authentication records (SPF, DKIM and DMARC) for your own domain, which make spoofing your domain harder. Check your email provider’s current documentation for setup.
• External sender banners to flag messages from outside the organization.
• Alerts for suspicious mailbox rules, especially automatic forwarding and deletion rules, which attackers use to hide their activity.
• Impersonation protection features in your email service, where available.
• Sign-in monitoring for unusual locations or impossible travel.

If Money Has Already Moved

Speed matters. Contact your bank immediately and ask about recalling the transfer; the chances are better the sooner you act. Report to the appropriate authorities in your jurisdiction, notify your cyber insurer if you hold a policy, and preserve the emails and headers. Then investigate how the message got through and fix the procedure gap. Legal and reporting duties differ by location, so involve qualified advisers.

Frequently Asked Questions

Is BEC the same as phishing? They overlap. Phishing often steals credentials, while BEC focuses on tricking people into payments or data disclosure, sometimes using a stolen mailbox obtained through phishing.

Can filters stop it? They help, but BEC messages often contain no links or attachments, so they slip through. Verification procedures remain the main defense.

Why do attackers target finance and HR? Those teams can move money or release valuable personal data, and they are used to handling requests quickly.

Should executives be exempt from verification? No. Impersonating them is the entire premise of the scam. The rule should apply to everyone, especially them.

How often should we train staff? Short, regular refreshers with real examples beat one long annual session. Tailor them to the people who handle payments.

Next Step

Write a single-page payment verification rule covering bank-detail changes and urgent transfer requests, then get your finance lead and one executive to sign off on it. A rule leadership publicly follows is one the team will follow.