Business Email Compromise: How Fraudsters Get Inside Familiar Conversations

How Business Email Compromise Works

BEC does not always begin with an obviously suspicious message. A criminal may compromise a legitimate email account and monitor conversations before acting. That can reveal vendor relationships, invoices, payment timing and the language employees normally use.

The fraudulent request can then arrive with enough context to appear routine.

Common BEC scenarios include:

• a vendor providing new bank or wire instructions;
• an executive requesting an unusual payment;
• an employee asking to change direct-deposit information; or
• a trusted third party appearing to revise transaction instructions.

Familiarity Does Not Confirm Authenticity

The strength of BEC is often context. The sender may be known. The invoice may be real. The timing may make sense. In some cases, the email account itself may be legitimate but compromised.

That is why a conversation that seems familiar should not independently authorize a change in payment instructions.

Before you change where money goes, confirm new or revised payment instructions through a separate, trusted channel using contact information already on file, not the phone number, email address, or link supplied in the request.

Before You Send Money, Ask These Four Questions

Use a simple verification framework before approving an unexpected payment, changed instruction or unusual request.

Learn More

Build Controls Around the Change

Businesses can reduce BEC exposure by treating changes to payment instructions as exceptions that require additional verification.

Consider the following:

• Out-of-band verification: confirm changes by phone or another pre-established channel.
• Dual approval: require a second authorized employee before releasing significant payments.
• Segregation of duties: separate initiation, approval, and reconciliation when practical.
• Multi-factor authentication: strengthen access to email and other sensitive business systems.
• Employee training: make change instructions, urgency, and requests to bypass procedure recognizable escalation points.

If Money Has Already Been Sent

Act immediately if you suspect you’ve been compromised already. Contact your financial institution and ask whether the payment can be recalled or investigated. Preserve the email thread, transaction details, and related records, then report the incident through the FBI’s Internet Crime Complaint Center. Speed matters because the opportunity to recover transferred funds can narrow quickly.

A Simple Reminder

BEC succeeds by making a fraudulent change look like part of a legitimate process. When the instructions change, the verification process should change with them.

Treasury Management Team

Payment controls can reduce reliance on a single person, message or approval point when money moves. Talk with a TRB Treasury Management specialist about tools and processes that may fit your business.

Schedule an Appointment