Organizations can reduce business email compromise (BEC) risk by securing email accounts, independently verifying payment and supplier changes, enforcing transaction authorization controls, training employees on realistic fraud scenarios, and measuring whether those controls work in actual business processes. Finance and procurement teams are especially important because they manage the relationships, records, and transactions that attackers seek to manipulate. Effective prevention requires security, finance, procurement, and risk leaders to understand how fraud can move through the workflow from the first deceptive message to the final payment.
Business email compromise is an expensive reminder that a perfectly functioning financial system can still process a fraudulent transaction. The invoice may be genuine, the supplier may be real, the purchase order may be approved, and the employee may follow most of the established procedure. If an attacker successfully changes the destination of the payment, the rest of the process can operate exactly as designed while sending the money somewhere it was never supposed to go.
The scale of the problem is substantial. The FBI's 2025 Internet Crime Report recorded approximately $3.05 billion in reported BEC losses in 2025. That figure reflects reported losses, rather than a complete accounting of every incident, but it demonstrates why BEC remains a serious business risk.
For CISOs and fraud leaders, the important question is where the organization can interrupt the attack. Email security matters, but so do supplier onboarding, master-data changes, payment authorization, exception handling, and the behavior of the people operating those processes.
Business email compromise is a form of fraud in which attackers impersonate trusted people or organizations, or misuse compromised communication accounts, to persuade someone to transfer money, disclose information, or take another unauthorized action. Common targets include finance departments, accounts-payable teams, procurement staff, executives, and employees responsible for managing supplier relationships.
The attacker may pose as a CEO requesting an urgent transfer, a supplier announcing new banking details, or an employee asking for payroll information to be changed. In more sophisticated cases, attackers gain access to legitimate email accounts and monitor correspondence until they identify a suitable transaction. The fraudulent instruction may then arrive inside an existing conversation, surrounded by familiar names, authentic invoices, and a credible business history.
The FBI's guidance on business email compromise describes spoofed accounts, targeted phishing, malware, and access to legitimate email conversations as common methods. The attack may involve several stages, and the message that ultimately causes the loss may be one of the least suspicious communications the employee receives that day.
This creates a particular challenge for awareness programs. Employees may be excellent at identifying generic phishing messages and still struggle with a fraudulent instruction embedded in a legitimate supplier relationship.
Supplier payment fraud often begins long before anyone receives the request to change a bank account.
An attacker may compromise a supplier's mailbox, monitor invoice correspondence, identify payment schedules, or gather information about the people who approve changes. They may also impersonate the supplier using a similar-looking domain, a forged message, or a convincing collection of supporting documents. Their objective is to introduce fraudulent payment instructions at a point where the business is already expecting to act.
Imagine a manufacturing company with a long-standing equipment supplier. The supplier has delivered a legitimate order, the invoice matches the purchase order, and payment is due. An accounts-payable employee receives a message from someone who appears to be the usual supplier contact, explaining that the supplier has changed banks and asking for the payment to be redirected.
Nothing about the underlying purchase is fraudulent. The equipment arrived, the invoice is valid, and the amount is correct. The only malicious element is the account receiving the funds.
That makes supplier payment fraud particularly effective. Employees have a legitimate reason to complete the transaction, and the attacker needs to compromise only one part of the process.
A vendor master record contains information used to identify suppliers and process transactions, including payment details and authorized contacts. If an attacker can alter that information, future payments may be routed incorrectly without requiring a new fraudulent email for every transaction.
A banking change is therefore more consequential than it may initially appear. The immediate request may concern one invoice, but the change can affect multiple payments and persist until somebody discovers the problem.
Organizations should treat supplier banking modifications as controlled events requiring independent verification, appropriate authorization, and reliable records of who requested, confirmed, approved, and implemented the change. They should also examine whether an employee can modify the supplier's contact information and payment destination through the same workflow.
A verification process becomes substantially weaker if the attacker can first replace the trusted telephone number and then pass the callback verification using that newly modified number.
The strongest BEC defenses combine technical protections with financial and operational controls. Each addresses a different opportunity for the attacker, and their effectiveness depends on how they operate together.
| Control | What it helps prevent |
|---|---|
| Phishing-resistant MFA and secure account recovery | Unauthorized access to email and business accounts |
| Email authentication, filtering, and account monitoring | Some spoofed messages, malicious communications, and account misuse |
| Independent supplier verification | Fraudulent banking or contact changes |
| Segregation of duties and dual authorization | One person completing sensitive changes or transfers without oversight |
| Payment-change alerts and review periods | Fraudulent modifications reaching payment execution unnoticed |
| Defined escalation and exception procedures | Urgency or authority being used to bypass controls |
| Role-based training and realistic testing | Employees failing to recognize or execute required safeguards |
| Control monitoring and incident review | Persistent weaknesses remaining undetected |
The specific design will depend on the organization's transaction volume, technology, risk appetite, and supplier environment. A small business may use carefully controlled callbacks and dual approval, while a large multinational may integrate verification into its ERP, supplier management, and payment systems.
In either case, the controls need to address the full transaction path. Preventing a suspicious email from reaching an employee is valuable, but the organization should also be able to prevent a fraudulent payment when the email defense fails.
Finance teams should verify changes to supplier banking information through a trusted source established independently of the change request. The process should confirm the supplier's identity, the legitimacy of the specific change, and the authority of the person requesting it.
For example, an employee receiving a banking change by email might retrieve the supplier's approved contact details from an independently maintained vendor record and contact an authorized representative through that channel. The employee would then document the verification and follow any required approval procedure before updating the payment information.
The FBI specifically advises organizations to verify changes through existing contact information rather than telephone numbers supplied in the suspicious message. Its guidance also recommends additional approval for changes to vendor payment details. FBI guidance on protecting against BEC
The distinction between contacting a supplier and independently verifying a supplier matters. Replying to the original email may reach an attacker who controls the mailbox. Calling a number supplied in that email may reach the same attacker by telephone. Even a familiar voice should not automatically override the organization's approved process.
Our guide to designing verification processes to prevent impersonation fraud examines how to establish reliable channels, authority requirements, exception paths, and evidence standards across different business workflows.
Dual approval and segregation of duties reduce the likelihood that a single compromised identity, mistaken decision, or fraudulent instruction can produce a high-impact transaction.
In a well-designed process, the person requesting a change, the person verifying it, the person approving it, and the person releasing the payment may have distinct responsibilities. Organizations do not necessarily need four separate people for every transaction, but they should establish appropriate separation for the actions that carry the greatest risk.
The details matter. Two employees approving the same fraudulent request without independently establishing its legitimacy may provide little additional protection. Likewise, an approval process that allows an executive to bypass the normal rules through an informal message may create an attractive target for impersonation.
Consider a finance team that requires secondary approval for payments above a certain threshold but allows one employee to modify supplier banking information without additional verification. The payment may pass through the approval system while the destination has already been compromised.
A useful control review follows the sequence of actions rather than examining each approval in isolation. It asks whether the combined process would prevent an unauthorized change from becoming an authorized-looking payment.
Executive impersonation attacks exploit authority, urgency, and the employee's desire to help the organization. A fraudulent message may appear to come from the CEO, CFO, general counsel, or another senior leader and instruct the recipient to release funds, purchase something, disclose information, or bypass a normal approval.
The request may refer to a confidential acquisition, urgent supplier issue, sensitive legal matter, or time-critical business opportunity. The attacker often uses the apparent importance of the situation to discourage the employee from seeking independent confirmation.
Organizations should establish clear rules about which transactions require verification regardless of who requests them. Senior leadership must support those rules in practice, including when a genuine executive is inconvenienced by the procedure.
An employee who delays a payment to complete required verification should expect support from the organization. If the CEO regularly complains about security checks, employees will eventually learn that the policy is negotiable.
This is where BEC prevention intersects with organizational culture. Authority and hierarchy can influence whether employees challenge instructions, and those conditions are not always visible in technical security reporting.
We explored the broader implications of credibility and authority in Trust Issues: Why Cyber Risk Now Starts With What People Believe. In a BEC scenario, those beliefs can determine whether an employee invokes the control or proceeds with the request.
AI can make impersonation more convincing, personalized, and economical for attackers. Generative AI can produce polished messages that imitate business language, while synthetic audio and video may help attackers impersonate familiar executives, suppliers, or colleagues.
The FBI's 2025 Internet Crime Report discusses AI-enabled fraud and identifies BEC among the attack types that can incorporate generated messages and voice cloning. It also makes clear that BEC involves multiple tactics and that not every attack is AI-enabled.
That distinction is important for defenders. An organization may encounter AI-generated impersonation, a compromised supplier mailbox, a spoofed domain, or a combination of methods. Controls that depend on employees recognizing poor grammar, unfamiliar voices, or obviously suspicious messages become less dependable as attackers improve their presentation.
The more durable approach is to protect the consequential decision. If an organization requires independent verification before changing supplier banking details, the control should apply whether the request arrives through a convincing email, a synthetic voice message, or a genuine account being misused.
Our guide to defending against AI-enabled impersonation attacks explores how technical controls, verification, role-based training, and realistic testing can support that approach.
Traditional phishing training can help employees recognize malicious links, suspicious attachments, spoofed addresses, and other common warning signs. Those skills remain useful, especially because credential theft can provide the account access attackers later use for BEC.
Finance and procurement employees also need to understand how fraud moves through their specific workflows.
An accounts-payable employee may need to verify banking changes, recognize unusual invoice instructions, and follow escalation procedures when supplier information cannot be confirmed. A procurement manager may need to understand supplier onboarding risks and how compromised vendor records affect downstream payments. A treasury employee may need to recognize unauthorized payment instructions and follow controls around transaction release.
The relevant learning objectives should reflect the decisions these employees actually make.
At Cybermaniacs, we approach this through role-based risk and behavioral context. Our Cyber Learning Experience supports continuous learning, while our Cybersecurity Content as a Service can reinforce specific threats, business processes, and expected behaviors through targeted communications and campaigns.
A finance team preparing for a supplier fraud campaign should encounter examples that resemble its working environment. The language, documents, approval chains, and pressure points should be recognizable. Employees are more likely to apply a control when they understand how it connects to the work they perform every day.
BEC testing should examine the sequence of actions that could allow a fraudulent request to become a completed transaction.
A useful scenario might involve a supplier requesting new banking details shortly before a scheduled payment. The exercise could assess whether the employee recognizes the verification requirement, retrieves the correct contact information, confirms the request independently, follows the approval procedure, and prevents the change when evidence is insufficient.
Another scenario might involve an urgent payment instruction apparently issued by a senior executive. The test could examine whether the employee applies the normal transaction controls despite apparent authority, urgency, or confidentiality.
These exercises should be designed with finance, procurement, security, and relevant process owners. They should use controlled simulations and avoid actual unauthorized payment changes or disruption to legitimate business operations.
Testing also needs to distinguish between different types of failure. An employee may know the procedure but lack access to reliable supplier contact information. Another may follow the verification process but use an attacker-controlled channel. A third may understand the risk but believe that challenging an executive would be unacceptable.
Those outcomes can look similar in a simple pass/fail report, yet they require different responses.
BEC-related human risk should be measured across employee competency, observable behavior, organizational conditions, and exposure within the business process. Phishing simulation results are useful evidence, but they cannot independently establish whether payment and supplier verification controls are effective.
A more useful measurement approach examines several questions.
Competency: Do employees understand BEC scenarios, verification requirements, and the consequences of unauthorized changes?
Behavior: Do employees perform the required checks, approvals, and escalations when confronted with realistic requests?
Process: Are verification procedures clear, available, and consistently executed?
Culture: Do employees feel comfortable delaying a transaction or challenging apparent authority?
Exposure: Which roles, systems, suppliers, and transaction types create the greatest potential impact?
Control effectiveness: Does the combined process prevent fraudulent changes or transactions under realistic conditions?
The interpretation of those measures is critical. A high verification completion rate may be encouraging, but it provides limited assurance if employees are routinely calling telephone numbers supplied by the requester. Similarly, a low incident count does not prove that controls are effective if the organization rarely tests them or lacks reliable reporting.
We examine the difference between observed actions and underlying risk in What Is Verification Behavior in Cybersecurity, and How Do You Measure It?. Our thought-leadership article, The Best Human Risk Measurement Tool Is Useless If the Measurement Model Is Wrong, also explains why a metric needs an appropriate interpretation model before it can support a useful decision.
For security and finance leaders, the objective is to identify where the organization remains exposed and what intervention will improve the control. That may involve learning, process redesign, stronger technical safeguards, better supplier data, or leadership support for escalation.
Speed matters when a fraudulent payment may already have been initiated.
The organization should immediately contact its financial institution and request assistance with stopping or recalling the transfer. It should also activate its incident response procedures, preserve relevant evidence, assess whether accounts or systems have been compromised, and coordinate with appropriate legal, security, fraud, and business teams.
The FBI advises BEC victims to contact their financial institution promptly and report the incident to the Internet Crime Complaint Center. Early reporting may improve the possibility of financial recovery, although recovery is never guaranteed.
The incident review should examine the entire chain of events. How did the fraudulent instruction enter the process? What information made it credible? Which controls operated as intended? Where did verification or authorization fail? Were employees pressured to make an exception?
A well-run investigation should produce improvements to the control environment rather than simply identifying the person who processed the transaction.
If the same weakness remains available to the next attacker, the organization has learned very little from the incident.
BEC prevention requires shared understanding of the business process and clear ownership of the controls within it.
Finance and treasury leaders understand payment authorization, transaction limits, and financial exposure. Procurement and supplier management teams understand vendor onboarding, contact records, and relationship changes. IT and security teams understand account compromise, email threats, identity controls, and incident response. Risk and compliance teams can help establish assurance requirements and oversight.
Human Risk Management connects these disciplines by examining how the people operating the process understand, interpret, and execute the controls.
That connection matters because different teams may each believe they have addressed the problem. Security may have deployed email protection and phishing training. Finance may have established payment approval rules. Procurement may have a supplier onboarding procedure. Yet a fraudulent banking change may still pass through the gaps between those controls.
Cybermaniacs works with organizations to understand these underlying conditions through Human Risk Assessments and Baselines, targeted learning, behavioral measurement, cultural analysis, and Human Risk Management advisory services. The purpose is to identify where human and organizational risk actually exists, then connect that diagnosis to interventions that can improve outcomes.
A stronger program gives each function a clearer understanding of its responsibilities while allowing security and risk leaders to see how the controls perform together.
A practical starting point is to examine the workflows most likely to result in financial loss: supplier banking changes, new vendor setup, high-value payment approvals, payroll modifications, and executive payment requests.
Map how each workflow operates, including the people involved, systems used, verification requirements, approval paths, and exceptions. Identify where an attacker could introduce fraudulent information and whether the process would detect or prevent the resulting action. Pay particular attention to changes in trusted records, because those changes can influence multiple future transactions.
Then test a small number of realistic scenarios with the teams that perform the work. The results should help determine whether the most important gaps involve technology, process design, employee competency, behavioral execution, or organizational culture.
This is a useful place to begin because it produces a concrete view of risk and an actionable improvement plan. The organization can strengthen specific controls, establish meaningful measures, and repeat the assessment as processes and threats evolve.
Business email compromise succeeds when a fraudulent instruction is accepted and converted into an authorized business action. The email is the delivery mechanism, but the financial loss occurs through the transaction process.
A convincing supplier request may reach an employee who has done everything expected of them in security awareness training. The message may contain no obvious warning signs, and the business transaction may be entirely legitimate apart from the altered payment destination.
The organization still has opportunities to prevent the fraud. Independent verification, trusted supplier records, appropriate authorization, clear escalation procedures, and effective monitoring can interrupt the transaction before the money moves.
The strongest BEC programs make those controls part of how finance and procurement operate. They also examine whether employees can execute them under real business conditions, whether leaders support the procedures, and whether the organization has evidence that its defenses are working.
That is how BEC prevention becomes a measurable part of business resilience.
The most effective approach combines secure email and identity systems with independent verification of sensitive requests, strong payment authorization controls, role-based employee training, and realistic testing. Organizations should prioritize workflows where fraudulent instructions could result in financial loss, unauthorized access, or sensitive information disclosure.
Organizations should require independent verification using trusted supplier contact information, appropriate approval before modifying vendor records, and clear documentation of the change. They should also protect supplier master data, separate sensitive duties where appropriate, and review unusual changes before payments are released.
Multi-factor authentication reduces the risk of unauthorized account access, especially when phishing-resistant methods are used, but it does not prevent every BEC attack. Attackers may impersonate suppliers without compromising an account, misuse legitimately accessed accounts, or persuade authorized employees to initiate fraudulent transactions. Payment and verification controls remain necessary.
Finance employees should receive role-specific training based on realistic supplier changes, invoice fraud, executive payment requests, payroll modifications, and other relevant workflows. Training should emphasize the actions employees are expected to perform, including independent verification, authorization checks, and escalation when a request cannot be confirmed.
Organizations should examine verification and approval evidence, control exceptions, realistic scenario performance, employee competency, escalation behavior, and weaknesses identified through incidents or reviews. Those measures should be interpreted in the context of business processes, transaction risk, organizational culture, and the reliability of the underlying evidence.