Business email compromise succeeds because the request often looks normal. There may be no malware, no obvious spelling problem, and no dramatic warning from antivirus—just a familiar name asking for a payment, payroll change, or updated bank account.

The strongest defense is procedural. The FBI continues to advise businesses to verify financial requests through another trusted channel, because an email account or domain can be impersonated convincingly. Finance workflows should be designed so one believable message cannot move money by itself.

What to focus on first

Require independent verification for banking changes

Call a known contact using a number already on file before changing vendor bank details. Do not use the phone number provided in the same email that requested the change.

Use two-person approval for higher-risk payments

Separate the person who enters or requests a payment from the person who approves it. The threshold should reflect your business size and typical transaction values.

Protect finance and executive accounts

Use strong MFA, monitor unusual sign-ins, and limit mailbox forwarding. Compromised real accounts are particularly dangerous because the sender address is legitimate.

Watch for conversation hijacking

Attackers may wait inside a mailbox and reply in an existing invoice thread at the right moment. A familiar thread does not remove the need to verify changed payment instructions.

Have a fraud-response checklist

If money is sent to the wrong account, contact the financial institution immediately, then report the incident through appropriate law-enforcement channels such as IC3. Speed matters when attempting to recover funds.

Common ways this goes wrong

• Using email as both the request and the approval channel for wire transfers.
• Trusting a message because it contains accurate project details or a familiar signature.
• Failing to teach payroll and HR teams that direct-deposit change requests are also common fraud targets.

Make it part of normal operations

Keep the employee side of this simple and frequent. Short reminders tied to real workflows are more useful than a long annual lecture. Reinforce the behavior after onboarding, before predictable high-risk periods, and whenever an incident or near miss shows that the procedure was unclear. Employees should always know where to report a concern and should not have to decide alone whether something is “serious enough.”

Questions worth bringing to your next IT review

• Can we explain how the ‘Require independent verification for banking changes’ practice works today without relying on one person’s memory?
• Where do we have exceptions to ‘Use two-person approval for higher-risk payments’, and are those exceptions still necessary?
• Who owns the work behind ‘Protect finance and executive accounts’, and what evidence shows it is working?
• How would we discover that this control or process stopped working?
• What business, staffing, vendor, or technology change should trigger another review?

What a solid approach looks like

BEC defense works best when the company makes verification part of normal business etiquette. Calling to confirm a banking change should feel routine, not suspicious or awkward. A well-designed process protects both employees and vendors from having to make judgment calls under pressure.

If you want to go one level deeper, see Security Awareness Training.

If your organization would benefit from help reviewing the current environment or turning these ideas into a workable plan, Managed Endpoint and Server Protection from CTResources is available as a practical next step. The goal is to strengthen what matters without adding unnecessary complexity.