Business email compromise: red flags worth a phone call

Business email compromise does not usually look like malware. It looks like work: an invoice already in progress, a manager asking for a quick purchase, or a vendor changing bank details before the next payment run.

That normal appearance is the attack. The criminal may spoof a familiar address, compromise a real mailbox, or study an existing conversation before stepping into it. The FBI’s BEC guidance describes all three patterns and recommends independently verifying payment requests and changes to account information.

Spam filtering still matters, but this is why it cannot be the whole control. A message from a genuinely compromised vendor mailbox can pass technical checks and contain the correct signature, invoice history, and writing style. The employee approving money needs a process that survives a convincing email.

Red flags that justify a pause

One odd detail may be harmless. Two or three together deserve a callback.

• Banking instructions changed. A known vendor suddenly wants payment sent to a different bank, country, routing number, or beneficiary.
• The normal process is now a problem. The sender asks finance to skip the purchase order, second approval, or vendor-change form “just this once.”
• Urgency and secrecy arrive together. Phrases such as “I am in a meeting,” “do not call,” or “keep this between us” are designed to prevent verification.
• The address is almost right. A lookalike domain, different reply-to address, or unexpected personal mailbox is easy to miss on a phone.
• The request does not fit the person. An executive who never buys gift cards suddenly needs twenty of them, or a vendor who bills by ACH asks for cryptocurrency.
• The thread is right but the timing is strange. A compromised mailbox lets an attacker wait for a real invoice and replace only the payment instructions.
• The attachment or sign-in page is new. An unexpected “secure document” may be the step used to compromise your mailbox before the payment fraud begins.

Do not make grammar your deciding factor. Professional BEC messages are often clean because the attacker copied a real thread or is sending from the real account.

Use a verification channel the email cannot control

The strongest small-business control is simple: email can start a payment change, but email cannot approve it by itself.

1. Stop the transaction. A five-minute pause is cheaper than an urgent wire investigation.
2. Find a known contact method. Use the phone number already in your vendor record, contract, or independently verified website. Do not use the number printed in the suspicious message or attached invoice.
3. Speak to an authorized person. Confirm the beneficiary name, account details, amount, and reason for the change. A reply in the same email thread is not independent verification.
4. Require a second approver. The person entering new payment details should not be the only person approving the first payment to them.
5. Record the check. Note who called, who answered, the known number used, what was confirmed, and when.

This is not distrust of the vendor. It is a standing rule applied to every vendor, executive, and employee. The IC3 BEC guidance specifically recommends a secondary channel for account changes.

Put controls around the predictable requests

BEC prevention works better as an accounts-payable rule than as another annual phishing slide.

Vendor changes: lock changes behind a documented form, independent callback, and dual approval. Consider holding the first payment after a change long enough for normal review.

Executive requests: state in policy that executives will not ask staff to bypass purchasing controls by email. Leadership has to support the employee who pauses a suspicious request.

Payroll changes: verify direct-deposit changes through the HR system or a known employee contact, not by replying to an emailed form.

Mailbox security: require MFA, remove legacy authentication, and protect finance and leadership with phishing-resistant methods. Start with MFA for Microsoft 365 and move high-impact accounts toward phishing-resistant MFA.

Email operations: tune impersonation and spoofing controls without allowing one false positive to become a permanent bypass. Our spam-filter tuning guide covers that side of the problem.

If money may have moved

Treat this as a financial incident and a security incident at the same time.

1. Contact the originating financial institution immediately. Ask for its fraud or wire team and provide the transaction details. The FBI recommends asking the originating institution to contact the institution that received the transfer. A recall or hold may be possible, but recovery is not guaranteed.
2. Preserve the evidence. Keep the original message, headers, attachments, payment instructions, timestamps, phone numbers, and transaction details. Do not wipe the mailbox or delete the thread to “clean it up.”
3. Report the incident. File a detailed complaint at the official FBI Internet Crime Complaint Center and follow your insurer, counsel, bank, and local law-enforcement notification procedures. Type ic3.gov directly; the FBI has warned that criminals also imitate reporting sites.
4. Tell the real counterpart using a known channel. Their mailbox may be compromised too. Do not continue the investigation in the suspect thread.

Fast action improves the chance that financial institutions and law enforcement can intervene, but no process can promise that funds will be returned. Keep expectations honest while moving quickly.

If a mailbox may be compromised

Use a clean administrator session to contain the account. Block sign-in or reset the credential as appropriate, revoke active sessions, review MFA methods, and inspect forwarding rules, inbox rules, delegates, and connected OAuth applications. Preserve relevant logs before their retention window closes.

Then work outward. Search for messages sent from the account, identify anyone who received new payment instructions, and review other privileged or finance accounts for suspicious sign-ins. For Microsoft tenants, the five Entra sign-in checks provide a useful starting point.

Do not assume a password reset finishes the job. An attacker may have added a forwarding rule, consented an application, registered another authentication method, or already targeted customers from the mailbox.

Bottom line

The control that stops most BEC is not clever: important payment changes require a callback to a known number and a second approver. Back that process with strong identity security, then keep a first-response checklist that gets the bank, evidence, mailbox, and reporting work moving without making promises nobody can keep.