Most business email compromise attacks are preventable by layering three things: strong email authentication, phishing-resistant multi-factor authentication, and mandatory out-of-band verification before any payment goes out. DMARC set to enforcement and a callback verification rule are the two highest-impact controls you can put in place this month. If a fraudulent transfer already happened, call your bank immediately and file a complaint with the FBI’s IC3.
TL;DR:
- Implementing strict DMARC enforcement and out-of-band verification significantly reduces the risk of successful BEC attacks.
- Using phishing-resistant MFA and regularly reviewing third-party OAuth permissions help protect email accounts from takeover.
- Validating all payment and banking changes with callback calls from verified contact information helps prevent wire transfer fraud.
- Monitoring for unauthorized inbox rules, suspicious logins, and unexpected MFA failures can catch ongoing compromises early.
- Establishing a documented incident response plan that includes communication protocols and manual approval procedures improves recovery speed.
Table of Contents
- What Is Business Email Compromise, and Why Does It Slip Past Normal Defenses?
- What Are the Common BEC Tactics and Red Flags?
- How Do You Stop BEC With Email Authentication and MFA?
- Which Payment Approval Workflows Actually Prevent Wire Fraud?
- What Detection Signals Reveal an In-Progress Compromise?
- What Should You Do Immediately After a Fraudulent Transfer?
- How Do You Find Your Organization’s Weakest Points Before Attackers Do?
- How Do You Keep the Business Running After a BEC Incident?
- What Legal and Compliance Obligations Come With a BEC Incident?
- What Do Real BEC Cases Teach About Prevention?
- Why Layered Controls Beat Awareness Training Alone
- How a Managed Approach Puts These Controls Into Practice
- Ready to Close the Gaps in Your Email Security?
- Sources
What Is Business Email Compromise, and Why Does It Slip Past Normal Defenses?
Business email compromise, or BEC, is a scam where someone impersonates a trusted contact by email to trick your team into sending money or sensitive data somewhere it shouldn’t go. The typical outcomes are wire-transfer fraud, stolen W-2s, and leaked employee or client records.
Here’s the part that surprises most IT teams: BEC usually carries no malware, no malicious link, no attachment. It’s a well-written email from a name your accounts payable clerk trusts. That means your antivirus and spam filter have nothing to catch. The attack succeeds or fails based on whether a person double-checks before clicking “approve.”
The scale is bigger than most owners assume. The FBI’s Internet Crime Report put reported BEC losses at about $2.9 billion in a single year, making it one of the costliest categories of cybercrime the bureau tracks.
What Are the Common BEC Tactics and Red Flags?
Attackers rotate through a handful of proven playbooks. Training your staff to recognize the pattern, not just the scenario, is what makes the difference.
- Executive impersonation: an email that looks like it’s from the CEO, asking for an urgent, quiet wire transfer, often timed for late Friday afternoon.
- Vendor invoice fraud: a familiar supplier suddenly sends new banking details along with an overdue invoice.
- Payroll diversion: an “employee” emails HR asking to update direct deposit information right before a pay run.
- Thread hijacking: a real, ongoing email conversation gets taken over, so the fraudulent request appears inside a legitimate thread.
- Account takeover: an attacker who already controls a mailbox waits and watches before sending the fraudulent request from a real address.
- Legal or tax scams: a fake attorney or tax authority pressures for a rushed, confidential payment.
Watch for artificial urgency, a request that skips normal approval steps, a display name that almost matches a real contact, and any banking change delivered only by email.
How Do You Stop BEC With Email Authentication and MFA?
Technical controls won’t stop every attack, but they shrink the attack surface dramatically and give your team fewer fraudulent emails to fall for in the first place. NIST’s Trustworthy Email guidance lays out the core stack every business should have running.
- Publish SPF and DKIM records for every domain you send mail from, including marketing platforms and third-party tools. Gaps here are one of the most common reasons DMARC enforcement projects stall.
- Move DMARC from monitoring to enforcement. Start at
p=nonewith reporting turned on, confirm legitimate senders pass, then step up top=quarantineand finallyp=reject. Skipping straight to reject without reviewing reports is the fastest way to bounce your own invoices. - Require phishing-resistant MFA (security keys or platform authenticators, not just SMS codes) for finance staff, executives, and anyone with admin rights. Disable legacy authentication protocols that let attackers bypass MFA entirely.
- Lock down OAuth app permissions. Audit which third-party apps have access to mailboxes, and review delegated access and mail-forwarding rules on a recurring schedule, not just during an incident.
- Enforce TLS for server-to-server mail transport, and reserve S/MIME for messages carrying sensitive financial or legal content.
DMARC has real limits worth knowing. Even at full enforcement, it only protects your own domain. It does nothing against a lookalike domain like “yourcompany-inc.com” registered by an attacker. Pair enforcement with monitoring for close variations of your domain and consider registering the obvious misspellings yourself, a point Valimail’s guidance on BEC makes clearly.
Pro Tip: Review your DMARC aggregate reports monthly, not once and forget it. New SaaS tools get added to your email ecosystem constantly, and each one needs to be authorized in your SPF and DKIM records or it will start failing silently.
Which Payment Approval Workflows Actually Prevent Wire Fraud?
Here’s the uncomfortable truth: email authentication protects your inbox, not your bank account. A phishing-resistant MFA setup does nothing if your controller still approves a wire transfer because an email “from the CEO” said it was urgent. BEC is a payments and workflow problem as much as it is an email problem, and the fix lives in your approval process.
- Write a strict callback verification rule: never accept a change to payment or banking details based solely on a reply to the requesting email. Call the vendor or employee using a number pulled from your internal directory or an existing vendor portal, never a number supplied in the suspicious message itself.
- Apply a two-person rule to any wire above a set threshold (many SMBs use $5,000 to $10,000 as the trigger point) and to every first payment to a new vendor, regardless of amount.
- Build a vendor onboarding checklist that captures verified banking details once, then log every subsequent change request in a vendor-change log reviewed monthly.
- Give exceptions a paper trail. Any deviation from the standard process, a rushed payment, a verbal approval, needs documented sign-off from two managers, not one person’s judgment call.
Small teams often assume these controls require expensive software. They don’t. A shared vendor-change form, a simple spreadsheet log, and a written callback policy get most of the benefit at almost no cost.
Pro Tip: Keep your vendor directory separate from your email system. If an attacker gains access to a mailbox, you don’t want the “verified” callback number sitting in the same compromised account.
What Detection Signals Reveal an In-Progress Compromise?
Catching an attacker before money moves usually comes down to watching for behavior that looks normal on the surface but is subtly wrong underneath. Attackers who gain access to a mailbox often add hidden forwarding rules to intercept vendor replies, so the account owner never sees the fraud unfold.
- Monitor for new inbox rules and auto-forwarding. A rule that quietly forwards or deletes messages containing words like “invoice” or “wire” is a classic sign of account takeover.
- Alert on impossible-travel logins, where the same account signs in from two distant locations within an implausible window.
- Watch for sudden MFA failures or unexpected push notifications, which often mean an attacker has valid credentials and is trying to push through the second factor.
- Flag new OAuth consent grants, especially to unfamiliar third-party apps requesting mailbox or calendar access.
- Use your platform’s native audit logs (Microsoft 365 or Google Workspace) and feed them into a SIEM or managed detection service so patterns surface automatically instead of relying on someone noticing manually.
- Give employees a one-click “report phishing” button and a triage playbook that gets a suspicious email reviewed within minutes, not days.
What Should You Do Immediately After a Fraudulent Transfer?
Speed matters more than almost anything else in the first hours after a BEC payment goes out. Banks can sometimes claw back funds, but only within a narrow window.
- Call your bank’s fraud department immediately and request a fund recall. Ask exactly what documentation they need to process it.
- File a complaint with the FBI’s IC3 at www.ic3.gov and include full email headers, timestamps, and transaction details. This is the mechanism federal investigators use to trace and sometimes recover funds across banks.
- Isolate the affected mailbox, rotate credentials, force an MFA reset, and preserve logs and headers before anyone deletes anything in a panic.
- Notify finance, legal, and executive leadership right away and start a written incident timeline while details are still fresh.
- Bring in outside incident responders or legal counsel when the loss is significant, when regulated data may have been exposed, or when your internal team lacks forensic experience.
The FBI’s guidance on business email compromise stresses that fast reporting isn’t just about your own recovery. It also helps investigators connect your case to a broader pattern that might lead to an arrest or a fund freeze elsewhere in the banking system.
How Do You Find Your Organization’s Weakest Points Before Attackers Do?
Most businesses don’t get hit by a random BEC attempt. They get hit at the specific spot where a human process has a gap: the accounts payable clerk who’s never been trained to question an urgent request, the vendor list nobody has reviewed in two years, the shared inbox with no MFA because “it’s just for scheduling.”
A useful risk assessment starts with mapping every path money can leave your organization: wires, ACH transfers, payroll changes, gift card purchases. For each path, ask who can approve it alone and what verification, if any, is required. Any path where a single person can approve a payment based only on an email is a high-risk gap.
Next, inventory who holds elevated email or financial system access, and check whether phishing-resistant MFA actually covers all of them. It’s common to find MFA rolled out to most of the company except a handful of legacy accounts or shared mailboxes that got missed during setup.
Finally, look at your vendor and customer email history for domains that closely resemble ones you deal with regularly. A structured vulnerability analysis that covers both technical configuration and human workflow tends to surface these blind spots faster than a checklist focused only on software patching. Vulnerability scoring frameworks can help rank which gaps to fix first, since not every business has the budget to close everything simultaneously.
How Do You Keep the Business Running After a BEC Incident?
Recovering from BEC isn’t just about getting money back. It’s about keeping operations moving while the investigation and cleanup happen in the background, which is where a lot of businesses stumble without a plan already written down.
Start with a communication tree that doesn’t depend on the compromised email system. If attackers had access to your inbox, you need a phone tree or a messaging app the whole team can reach without relying on the very system under investigation. Designate who talks to the bank, who talks to affected vendors or customers, and who handles employees, before an incident ever happens.
Payroll and payment continuity need a backup path too. If your normal approval chain runs through a compromised account or a manager who’s now under scrutiny, who has the authority to approve legitimate payments in the meantime? Write that answer down now, not during the chaos.
Build a short recovery checklist that covers system restoration order (which accounts get reset first), how long affected systems stay isolated before returning to normal use, and who signs off that the environment is clean. Businesses that have run a tabletop exercise on this scenario recover measurably faster than ones improvising for the first time during a real event, mostly because decisions that would normally take hours of debate are already made.
What Legal and Compliance Obligations Come With a BEC Incident?
BEC incidents often trigger obligations well beyond fixing the technical problem, and the details depend heavily on what kind of data or funds were involved.
If the incident exposed personal information, such as employee W-2s or customer records, state breach notification laws may require you to notify affected individuals within a specific timeframe. Requirements vary by state, so a business operating across multiple states needs to check each one rather than assuming a single national standard applies. A breach response plan built before an incident happens makes this step far less chaotic.
Regulated industries carry extra weight. Healthcare organizations covered by HIPAA, for instance, treat certain BEC-related data exposures as reportable events, and a HIPAA risk assessment should already account for email-based attack paths, not just system access controls. Government contractors and organizations handling criminal justice information face their own frameworks, including CJIS and CMMC, which expect documented email security controls as part of ongoing compliance, not a one-time checkbox.
Cyber insurance policies frequently include specific requirements too, sometimes mandating that MFA be in place or that incidents get reported within a set window to preserve coverage. Reading your policy’s fine print before an incident, not after, avoids an unpleasant surprise on top of the fraud itself. Working with compliance consulting that understands both the technical controls and the regulatory overlay saves significant time when an incident actually occurs.
What Do Real BEC Cases Teach About Prevention?
Publicly reported BEC cases tend to share a pattern: the fraud wasn’t sophisticated, but the verification step was missing. A vendor invoice fraud case might involve an attacker who spent weeks quietly monitoring a real email thread between a company and its supplier, watching for the natural moment an invoice was due, then inserting a “updated banking details” email at exactly the right time. Nothing about the email looked unusual because it fit seamlessly into a conversation that was already happening.
Executive impersonation cases follow a similar rhythm. An attacker researches a company’s leadership structure using public sources like LinkedIn and press releases, learns who reports to whom, and times a request for a confidential wire around a moment when the real executive is known to be traveling and hard to reach for a quick confirmation.
The prevention successes worth learning from are less dramatic than the failures. A finance team that had adopted a strict callback verification rule caught a payroll diversion attempt simply because the “employee” requesting a direct deposit change couldn’t answer a basic verification question the HR team asked over the phone. No special software caught it. A written policy and a five-minute phone call did. That’s the pattern behind most prevention wins: not a clever piece of technology, but a process that forces a human pause before money moves.
Why Layered Controls Beat Awareness Training Alone
Most advice on this topic leans hard on training employees to “spot the phishing email.” That’s not wrong, but it puts the entire burden on a person having a sharp, skeptical moment during a busy afternoon, and BEC emails are specifically engineered to slip past exactly that kind of scrutiny. A well-crafted thread hijack doesn’t look suspicious to a tired employee juggling twelve other things. It looks like Tuesday.
The uncomfortable position worth stating plainly: if your prevention strategy depends primarily on people noticing something is off, you’ve built your defense around the least reliable layer available. The businesses that actually stop BEC losses are the ones that assume someone, eventually, will click or approve something they shouldn’t have, and then build a process that catches it anyway. That’s what a callback rule and a two-person approval threshold do. They don’t require anyone to be a hero. They just require the process to run as written.
Technical controls like DMARC enforcement matter, but they’re a volume reducer, not a fraud stopper. The fraud stops in accounts payable, at the moment someone either makes a verification call or skips it. Total Cyber’s experience working with small and mid-sized businesses points to the same conclusion every time: the organizations with the fewest losses aren’t the ones with the most expensive tools. They’re the ones where a $5,000 wire simply cannot leave the building without a second person and a phone call, no matter how convincing the email looked.
— Alden
How a Managed Approach Puts These Controls Into Practice
Reading a checklist is one thing. Running DMARC enforcement, phishing-resistant MFA, mailbox rule monitoring, and staff training as an ongoing program is another. A managed cybersecurity provider builds this out as a repeatable cycle: a risk assessment identifies where payment approvals and email authentication have gaps, prioritized fixes close the highest-risk items first, cyber awareness training gets your finance and admin staff practicing callback verification until it’s second nature, and ongoing monitoring watches for the inbox rules and login anomalies that signal an account takeover in progress.
That cycle only works when someone is actually watching the logs on a Tuesday afternoon, not just during a quarterly review. If you want a second set of eyes on where your organization stands, start with an assessment through a managed service provider’s MSP form.
Ready to Close the Gaps in Your Email Security?
You’ve seen what stops business email compromise: authentication that actually gets enforced, MFA that resists phishing, and a payment approval process that doesn’t bend for a convincing email. What most businesses lack isn’t the knowledge. It’s someone dedicated to keeping every piece of that system running correctly month after month, which is a full-time job most in-house IT teams don’t have room for on top of everything else on their plate.
A managed cybersecurity provider can bring managed cybersecurity monitoring, identity protection, and cyber awareness training together as one ongoing service, backed by a team that understands both the technical side and the compliance pressure many businesses face. Rather than piecing together DMARC configuration, MFA rollout, and staff training as separate projects, you get one team accountable for all of it working together.
Fill out the MSP assessment form to get a clear picture of where your email security and payment approval processes stand today, and what it takes to close the gaps before an attacker finds them first.