Business Email Compromise (BEC): Preventing Wire Fraud
Note: This is general information and not legal advice.
On this page
Executive Summary
- It bypasses many “security tools” because it looks like normal business communication.
- Once funds move, recovery is difficult—prevention and fast response are key.
- Regulated teams also face privacy and reporting risk when BEC targets payroll/HR data.
- Process controls: out-of-band verification and dual approval for risky changes and payments.
- Identity controls: MFA + admin hygiene + sign-in risk monitoring.
- Email/domain controls: DMARC/DKIM/SPF to reduce spoofing and brand impersonation.
- Detection: alerting for suspicious sign-ins and mailbox forwarding/rules changes.
Common BEC scenarios (what teams actually see)
- Vendor payment change: “We updated our bank details, please use this routing/account number.”
- CEO / executive urgency: “I need this wired in the next 30 minutes, I’m in a meeting.”
- Payroll / W-2 request: A request for employee tax info or direct deposit updates.
- Compromised vendor mailbox: The email is truly from your vendor, but the invoice details were altered.
The attacker’s advantage is timing and context. They often wait until they see an invoice thread, a project kickoff, or a quarter-end payment rush.
Non-negotiable process controls (the layer that stops fraud)
1) Out-of-band verification for payment changes
If banking instructions change, verify using a known-good phone number from your vendor master record. Don’t reply to the email thread and don’t use a number contained in the email.
2) Dual approval for high-risk payments
Require two independent approvals for wires/ACH above a threshold, and for any “first payment” to a new payee.
3) A written exception process
Fraud often succeeds because “this one time” bypasses the controls. Decide what exceptions are allowed, who can approve them, and how they’re documented.
Technical controls that reduce BEC risk
- Email authentication: implement DMARC/DKIM/SPF to reduce spoofing.
- MFA everywhere: start with MFA for email, finance apps, and admin roles.
- Conditional access: use conditional access to reduce risk from unknown devices/locations.
- Least privilege: reduce admin sprawl with RBAC and access reviews.
- Logging and alerting: centralize critical events (sign-ins, mailbox rules, forwarding) via a SIEM approach.
If you suspect BEC: the first hour checklist
- Freeze the payment: contact your bank immediately (recall/hold). If money moved, speed matters.
- Contain the account: reset credentials, revoke sessions, review MFA methods, and check for mailbox forwarding/rules.
- Preserve evidence: keep the email headers, messages, and any related ticketing notes.
- Notify the right owners: finance leadership, IT/security, and the vendor relationship owner.
- Report: file a complaint with IC3 and follow your organization’s reporting requirements.
We recommend practicing this response path as part of an incident response tabletop exercise.
Common Questions
What is Business Email Compromise (BEC)?
BEC is email-based fraud where attackers impersonate executives, vendors, or partners to trick someone into sending money, changing payment instructions, or sharing sensitive information.
Is BEC just phishing?
BEC often uses phishing techniques, but the goal is usually financial fraud or data theft (not installing malware). Many BEC emails have no links or attachments.
What’s the most effective way to prevent wire fraud?
Strong payment procedures: out-of-band verification of changes to payment instructions, dual approval for high-risk payments, and clear exceptions handling. Technology helps, but process is the critical layer.
Do DMARC, DKIM, and SPF stop BEC?
They reduce domain spoofing and impersonation risk, but they do not stop attacks from compromised accounts or free email domains. Pair email authentication with payment verification procedures.
What should we do if we think we sent money to an attacker?
Treat it as urgent. Contact your bank immediately to attempt a recall, preserve email evidence, and file a report (IC3). Time matters.
How does N2CON help with BEC prevention?
We help implement email/domain protections (DMARC/DKIM/SPF), strengthen identity controls (Multi-Factor Authentication (MFA)/conditional access), improve logging/alerting, and help design verification procedures that fit how your team actually works.
Where this fits in your program
BEC sits at the intersection of finance operations and security operations. If you are building a durable program, pair BEC controls with: identity foundations, vendor management, and incident readiness.
Sources & References
Want to pressure-test your wire fraud controls?
We can review your payment workflows, harden identity/email controls, and set up the monitoring you need to catch account compromise early.
Contact N2CON