Stopping business email compromise and wire fraud: a small-business playbook
Business email compromise (BEC) doesn't need malware. A criminal either breaks into a real mailbox or imitates one, then asks someone to pay an invoice to a "new" bank account, buy gift cards, or change a payroll deposit. It works because the request looks routine.
It is also expensive. The FBI IC3 2025 Internet Crime Report lists business email compromise as the second-costliest category of reported cybercrime in 2025, at about $3.05 billion in reported losses from 24,768 complaints.
The three most common BEC patterns
- Supplier bank change: an email (often from a real, compromised supplier mailbox) says bank details have changed and the next payment should go to a new account.
- Executive request: "I'm in a meeting, I need you to send a wire / buy gift cards right away. Keep it quiet."
- Payroll diversion: an "employee" asks HR to update their direct-deposit details.
Controls that actually stop it
1. Call-back verification for any payment or bank change
The most effective control is procedural: any new payee, change of bank details or unusual payment request is verified by phone, using a number you already have on file, never one from the email or invoice. Write it into policy and keep a short log of verifications.
2. Dual approval above a threshold
Set a dollar threshold above which two people must approve a payment. Most business banking platforms support this. It stops a single tricked or compromised person from sending money.
3. Slow down "urgent and secret"
Tell staff explicitly that urgency plus secrecy is a red flag, and that nobody will be in trouble for pausing to verify a request from the boss.
4. Harden mailboxes
- MFA on every mailbox, ideally phishing-resistant for finance staff (see our MFA guide).
- Alerts for new auto-forwarding or inbox rules, a common trick to hide replies.
- Block automatic forwarding to external addresses unless approved.
- Publish SPF, DKIM and DMARC for your domain to make spoofing harder.
- Tag external emails with a warning banner.
5. Train with real examples
Show finance and admin staff examples of the patterns above. Short, frequent reminders beat one annual slideshow.
If money has already been sent
- Call your bank's fraud line immediately and ask them to recall the transfer. Speed matters.
- File a complaint at ic3.gov.
- Notify your cyber insurer if you have coverage. Social-engineering fraud coverage often has specific conditions, so check your policy.
- Reset the compromised mailbox password, revoke sessions and remove malicious rules.
- Warn customers and suppliers who may receive follow-up fake messages.
- Record everything in your incident log (see how to write an incident response plan).
Put it in writing
Our Email & Phishing Policy template includes a payment and banking-change verification procedure, technical protections and a "what to do" section staff can follow. The Incident Response Plan template includes a business-email-compromise quick-action checklist.