01What business email compromise looks like
Business email compromise, or BEC, is fraud that uses business communications to persuade someone to transfer money or disclose sensitive information. A message may impersonate a manager, imitate a supplier or come from an actual compromised mailbox. It does not need a malicious attachment or a suspicious login page to cause damage.
Consider a fictional example: a supplier sends an invoice, then a second message says the company has changed banks. The invoice number, signature and previous conversation all look familiar. Those details support the story, but they do not authenticate the new bank account. If a mailbox has been compromised, the attacker may already know the payment schedule and the people involved.
02Verify the change, not just the sender
Treat a request to change bank details as a separate approval event. Call the supplier using a number already held in a trusted supplier record or contract. Do not use a number included in the suspicious message: it may connect you to the person attempting the fraud. Replying to the same email thread is not an independent check either.
Ask the known contact to confirm the change and follow your normal approval process before updating the payment record. For higher-risk payments, separate the person who changes supplier details from the person who authorizes the transfer. A second approval is useful only when the second person checks evidence rather than simply agreeing with the first.
03Recognize pressure without relying on perfect detection
Unexpected urgency, secrecy, a changed reply-to address or instructions to bypass the usual process deserve attention. Check the full sender address rather than the display name. But good spelling, an authentic logo and a familiar address are not guarantees. A real compromised account can pass those visual checks.
Build a process that allows staff to pause a payment without being punished for delaying it. If a senior manager appears to demand an exception, confirm through an established internal channel. The rule should apply to leadership as well as to suppliers; otherwise authority becomes a shortcut around the safeguard.
04If a transfer has already happened
Contact your bank immediately and explain that the transfer may be fraudulent. Ask about the available recall or reversal process; recovery is not guaranteed. Inform the responsible finance and security contacts, preserve the original messages and payment records, and report the fraud through the relevant local channels. In the United States, the FBI accepts reports through IC3.
If a company mailbox may be involved, have the responsible IT team investigate access, active sessions, forwarding rules and connected applications. Do not assume a password change alone completes the investigation. Then review how the payment was approved and repair the process without blaming the person who reported the problem.
05Practice the decision that protects the payment
Run a short, fictional supplier-change exercise with finance and procurement. Ask who would verify the request, where the trusted phone number is stored and what happens when the approver is unavailable. Do not send real payments or use real customer data in the exercise. The useful outcome is a clear, repeatable callback process—not a score showing who was fooled.