EMAIL & PAYMENT SECURITY

Business Email Compromise: How Small Organizations Prevent Payment Fraud

Business email compromise turns familiar communication into a fraud channel. The most effective defense combines protected accounts with payment procedures that remain reliable even when an inbox, vendor, or executive identity is impersonated.

What business email compromise looks like

Business email compromise, often called BEC, is fraud built around trusted business relationships. A criminal may take over a real mailbox, create a look-alike domain, impersonate an executive, or insert themselves into an existing invoice conversation. The request is designed to look ordinary: update bank details, release a wire, change payroll information, buy gift cards, or send sensitive documents.

The message may contain no malicious attachment or obvious link. That is why spam filtering alone cannot solve the problem. The attacker is exploiting authority, timing, familiarity, and a business process that allows one message to move money or information.

Warning signs that deserve a pause

Treat unexpected bank-detail changes, unusual urgency, secrecy, pressure to bypass normal approval, a new reply-to address, or a request made just before a deadline as reasons to verify. A request can also be fraudulent when it arrives inside a legitimate email thread. Small wording changes, an unavailable executive, or a vendor who suddenly insists on a different payment method may be the only clues.

The right response is not to ask employees to become perfect fraud detectors. It is to make sure suspicious or high-impact requests cannot succeed without a second, trustworthy check.

Build a payment process that survives a compromised inbox

Require independent verification for new payees, bank-account changes, payroll changes, and unusual payments. Use a known phone number from an existing record—not a number supplied in the request. Define dollar thresholds for secondary approval and never let urgency eliminate the verification step. Record who approved the change and how it was confirmed.

Separate the person who can create or change a payee from the person who releases payment whenever staffing allows. For very small teams, a documented callback and owner approval can still create meaningful friction. Vendors should know in advance that Cyber Valet-style verification is a protection for both sides, not a sign of distrust.

Protect the accounts attackers want

Enable multifactor authentication on email, financial systems, remote access, cloud storage, and administrative accounts. Prefer phishing-resistant methods such as security keys or passkeys when available. Disable legacy sign-in methods, remove unused accounts, limit administrator privileges, and review automatic forwarding rules and connected applications.

Use a managed password manager so every account has a unique credential and recovery does not depend on one person’s memory. Configure domain email authentication where appropriate, keep devices updated, and make sure employees know how to report a suspicious message without replying to it.

Make reporting fast and blame-free

Employees sometimes recognize a mistake only after clicking, replying, or sending information. A punitive culture delays the report and gives an attacker more time. Establish one clear reporting path and explicitly say that speed matters more than embarrassment. Train with realistic scenarios involving invoices, executive impersonation, payroll, cloud-file sharing, and vendor conversations.

If money or information was already sent

Act immediately. Contact the sending financial institution through a known number and request a recall or fraud response. Contact the receiving institution if your bank advises it. Report the incident to the FBI’s Internet Crime Complaint Center. Preserve messages, headers, payment records, timestamps, phone numbers, and account details; do not delete evidence while trying to clean up.

Notify internal decision-makers and contact cyber-insurance, legal, privacy, technology, and law-enforcement resources as appropriate. Secure affected accounts, revoke active sessions, reset credentials from a known-safe device, review mailbox rules and connected applications, and look for other altered invoices or conversations. Reporting and notification duties vary, so qualified legal and insurance guidance may be needed.

Measure whether the controls work

Review whether multifactor authentication covers every critical account, payment changes consistently receive independent verification, suspicious messages are reported quickly, and former-worker access is removed promptly. Test the process at least annually and whenever banking, staffing, or major vendors change.

Authoritative resources

The FBI explains the threat and reporting process in its Business Email Compromise public service announcement. CISA provides additional guidance for small-business cyber protection.