Business email compromise has become the most financially devastating form of cybercrime, with losses exceeding ransomware, data breaches, and all other cyber attacks combined. These attacks don't rely on malware or technical exploits—they manipulate people into voluntarily transferring money to criminals. A single convincing email impersonating a CEO, vendor, or attorney can result in six- or seven-figure losses that are rarely recovered. This guide shows you how to recognize BEC attacks, implement verification procedures that stop them, and ensure you have proper insurance coverage for when prevention fails.
Understanding Business Email Compromise
Business email compromise is a sophisticated scam that targets organizations making wire transfers or handling sensitive financial transactions. Unlike phishing attacks that cast wide nets, BEC attacks are carefully researched and specifically targeted. Criminals study their victims, learn organizational hierarchies, and craft convincing requests that exploit trust relationships.
What makes BEC particularly dangerous is that it bypasses technical security controls entirely. There's no malware to detect, no malicious links to block. The attack succeeds when a trusted employee follows what they believe are legitimate instructions from a boss, colleague, or business partner.
How BEC Attacks Work
1. Research and Reconnaissance
Attackers study the target organization using LinkedIn, company websites, press releases, and social media. They identify executives, finance personnel, and regular business partners. They learn who authorizes payments and who processes them. Weeks to months of preparation
2. Impersonation Setup
Criminals create convincing impersonations: spoofed email addresses, lookalike domains, or compromised legitimate accounts. They may register domains like "company-corp.com" or "cornpany.com" that look legitimate at a glance. Sophisticated identity theft
3. Strategic Timing
Attacks often coincide with real business events: during acquisitions, when executives travel, at end of quarter, or during busy periods when scrutiny is lower. Attackers may monitor compromised email to learn about upcoming transactions. Exploits real business context
4. The Fraudulent Request
The attacker sends a convincing email requesting a wire transfer, banking change, or sensitive information. The message creates urgency while discouraging verification: "I'm in a meeting—handle this quietly and quickly." Social engineering at its finest
BEC attacks succeed not because employees are careless, but because the attacks are designed to exploit normal business processes and trust relationships. The solution isn't blame—it's building verification procedures that make these attacks fail.
— FBI Internet Crime Complaint Center
Common BEC Attack Scenarios
BEC attacks follow recognizable patterns. Understanding these scenarios helps employees recognize attacks when they encounter them. While attackers continuously evolve their tactics, most BEC attempts fall into a few common categories.
CEO Fraud / Executive Impersonation
The Attack
An email appearing to come from the CEO or CFO requests an urgent wire transfer. The message emphasizes secrecy: "This is confidential—don't discuss with anyone until the deal closes." The request bypasses normal approval processes by invoking executive authority.
These attacks target employees with payment authority and exploit the natural reluctance to question executives. They often coincide with real executive travel or known busy periods when direct verification seems impractical.
Vendor Invoice Fraud
The Attack
Criminals impersonate a regular vendor and request payment to "updated" bank account information. The fake invoice looks identical to legitimate ones—same logo, format, and amounts. Only the payment details have changed to route funds to criminal accounts.
Vendor fraud often involves compromising the actual vendor's email system, giving attackers access to real invoices, communication history, and payment timing. This insider access makes the fraud nearly indistinguishable from legitimate transactions.
Attorney or Professional Impersonation
The Attack
Attackers pose as attorneys handling confidential matters—acquisitions, settlements, or regulatory issues. They emphasize urgency and secrecy, claiming that discussing the matter could jeopardize the deal or violate confidentiality agreements.
Legal impersonation attacks exploit the expectation of confidentiality in attorney communications. Victims hesitate to verify because they've been told the matter is secret. These attacks frequently target real estate closings and merger transactions.
Payroll Diversion
The Attack
An email appearing to come from an employee requests a change to their direct deposit information. The message is simple and routine—exactly the kind of request HR processes regularly. Future paychecks go to criminal accounts until the real employee notices.
Payroll diversion targets HR and payroll departments. Individual amounts are smaller than wire fraud, but the attack can continue for multiple pay periods before detection. Employees don't realize their pay is missing until they check their bank accounts.
Real Estate Transaction Fraud
Real estate closings are prime BEC targets. Criminals monitor email threads between buyers, sellers, agents, and title companies. At closing time, they send fraudulent wire instructions that divert down payments—often hundreds of thousands of dollars—to criminal accounts. Always verify wire instructions by phone using independently obtained numbers.
Red Flags That Signal BEC Attacks
BEC attacks leave clues. While sophisticated attackers minimize obvious errors, careful attention reveals warning signs. Training employees to recognize these red flags is your first line of defense.
Email Warning Signs
| Red Flag | What to Look For | Why It Matters |
|---|---|---|
| john.smith@company-inc.com vs john.smith@companyinc.com | Lookalike domains are easy to miss at a glance | |
| Email from CEO, but replies go elsewhere | Attackers need responses to go to accounts they control | |
| "Must be completed today" "Don't discuss with anyone" | Prevents careful review and verification | |
| Requests sent late Friday, holiday weekends | Reduces chance of verification before processing | |
| "I'm in meetings all day" "Contact me only by email" | Voice verification would expose the fraud | |
| New bank account, different wiring instructions | Legitimate changes are rare and should always be verified |
Request Warning Signs
- Bypasses normal procedures — Requests to skip approval chains, expedite payments outside normal processes, or handle transactions "differently this time" should trigger verification.
- Requests secrecy — Legitimate business rarely requires hiding transactions from colleagues. Secrecy requests prevent the natural verification that would expose fraud.
- New or unusual recipients — First-time wire recipients, especially international accounts, deserve extra scrutiny. Why is this payment going somewhere new?
- Round numbers or slightly off amounts — Real invoices have specific amounts. Round numbers like $50,000 or amounts slightly different from expected may indicate fraud.
- Poor grammar or unusual tone — While sophisticated attackers avoid obvious errors, writing style that doesn't match the supposed sender is a warning sign.
When Email Accounts Are Compromised
The most dangerous BEC attacks come from actually compromised email accounts—not spoofed addresses. When attackers control a real executive or vendor email account, there are no email authentication failures to detect. The message comes from a legitimate source. This is why verification procedures that go beyond email are essential.
Payment Verification Procedures
Technical controls alone cannot stop BEC attacks because the attacks exploit human trust, not technical vulnerabilities. The solution is verification procedures that ensure payment requests are legitimate before money moves. These procedures must be mandatory, consistently applied, and resistant to social engineering pressure.
The Callback Verification Protocol
Verification Procedure Steps
- Receive payment request — Document the request including sender, amount, recipient, and stated purpose. Note any unusual aspects or urgency language.
- Look up contact information independently — Find the requester's phone number from your records, not from the email. For vendors, use the number from your original contract or previous verified correspondence.
- Call to verify — Speak directly with the person who supposedly sent the request. Verify the specific details: amount, recipient account, and purpose. Document the verification call.
- Verify banking changes through secondary channel — Any change to payment details requires verification through an established secondary contact at the vendor or partner organization.
- Process only after positive verification — Never process payments based solely on email authorization, regardless of who appears to have sent it or how urgent it seems.
Verification Requirements by Transaction Type
| Transaction Type | Verification Requirement | Additional Controls |
|---|---|---|
| Mandatory callback verification | Dual approval for large amounts | |
| Verify through known contact | Holding period before first payment | |
| Verify with secondary contact at vendor | Written confirmation on vendor letterhead | |
| Verify with executive directly | No exceptions for urgency claims | |
| Verify with employee in person or by video | Waiting period before change takes effect | |
| Verify wire instructions by phone | Use only numbers from signed documents |
Make Verification Non-Negotiable
The most important aspect of verification procedures is that they cannot be bypassed. Executives must support verification even when it delays their requests. Finance staff must feel empowered to verify without fear of pushback. A culture where verification is expected stops BEC attacks cold.
Technical Controls and Email Security
While BEC attacks ultimately exploit human judgment, technical controls reduce the number of fraudulent emails that reach employees and help identify suspicious messages. A layered email security approach catches many attacks before they require human detection.
Email Authentication
SPF (Sender Policy Framework)
SPF records specify which mail servers are authorized to send email for your domain. Receiving servers can check whether incoming mail claiming to be from your domain actually came from authorized servers. Implement SPF for your own domain and configure your mail system to check SPF on incoming mail.
DKIM (DomainKeys Identified Mail)
DKIM adds a digital signature to outgoing emails that receiving servers can verify. This proves the message wasn't modified in transit and actually came from the claimed domain. Implement DKIM signing for outgoing mail and verify DKIM signatures on incoming mail.
DMARC (Domain-based Message Authentication)
DMARC ties SPF and DKIM together and tells receiving servers what to do with messages that fail authentication. A properly configured DMARC policy with "reject" enforcement prevents attackers from spoofing your domain. DMARC also provides reporting to help identify abuse attempts.
Additional Technical Controls
| Control | What It Does | BEC Protection |
|---|---|---|
| Adds visible warning to emails from outside your organization | Alerts recipients that impersonation emails are external | |
| Identifies domains similar to yours or key partners | Catches typosquatting and impersonation domains | |
| Warns when display name matches internal executives but email doesn't | Exposes CEO impersonation from external addresses | |
| Detects suspicious mailbox rules, forwarding, unusual access | Identifies compromised accounts attackers are using | |
| AI/ML analysis of email content for BEC indicators | Flags suspicious requests based on behavior patterns |
Protect Executive Accounts
CEO and CFO email accounts are high-value targets. Apply enhanced security: strong unique passwords, hardware MFA tokens, restricted sign-in locations, and enhanced monitoring. Consider dedicated devices for executive email access. A compromised executive account enables the most damaging BEC attacks.
Technical Controls Have Limits
Email authentication stops domain spoofing but not lookalike domains. Advanced threat protection catches patterns but sophisticated attackers adapt. No technical solution stops an attacker who has compromised a legitimate email account. Verification procedures remain essential even with excellent technical controls.
Employee Training and Awareness
Every employee who handles financial transactions, payment information, or sensitive data needs BEC awareness training. The goal isn't to create paranoia—it's to build healthy skepticism and automatic verification habits. Well-trained employees are your last line of defense when technical controls fail.
Key Training Elements
- Real examples and scenarios — Show actual BEC emails (anonymized). Walk through how attacks succeed and how verification would have stopped them. Real examples are more memorable than abstract concepts.
- Verification procedures — Train specifically on your organization's verification requirements. Practice the callback verification process. Make sure everyone knows the procedures and feels empowered to use them.
- Red flag recognition — Teach the warning signs covered in this guide. Help employees recognize urgency tactics, unusual requests, and email impersonation techniques.
- Escalation procedures — Employees need to know how to report suspicious requests and who to contact when something seems wrong. Make escalation easy and consequence-free.
- No-blame culture — Emphasize that reporting suspicious activity is always right, even if it turns out to be legitimate. Employees who fear punishment for false alarms won't report real attacks.
Role-Specific Training
| Role | Specific Focus | Training Frequency |
|---|---|---|
| Wire fraud scenarios, vendor impersonation, banking change procedures | Quarterly with simulations | |
| Direct deposit fraud, W-2 scams, employee impersonation | Quarterly, especially before tax season | |
| How their identities are exploited, supporting verification culture | Annual with ongoing reinforcement | |
| Handling requests on behalf of executives, verification authority | Quarterly with scenario practice | |
| Basic BEC awareness, reporting procedures | Annual with periodic reminders |
Responding to a BEC Attack
If you discover a wire transfer went to criminals, speed is critical. Funds can sometimes be recovered if you act within hours. Every minute matters. Have response procedures ready before you need them.
Immediate Response Steps
- Contact your bank immediately — Call your bank's wire fraud department. Request a wire recall or hold. Banks have limited time windows to attempt recovery from receiving banks.
- Contact the receiving bank — If you know which bank received the funds, contact them directly as well. Request a hold on the funds pending investigation.
- File an FBI IC3 complaint — Report to the FBI's Internet Crime Complaint Center at ic3.gov. For significant amounts, the FBI may be able to work with banks to freeze funds.
- Notify your cyber insurance carrier — Report the incident to your insurance carrier immediately. Social engineering coverage has specific notification requirements.
- Preserve evidence — Save all emails related to the fraudulent request. Document the timeline of events. This evidence supports recovery efforts and insurance claims.
- Investigate the attack vector — Determine how the attack succeeded. Was an email account compromised? How did attackers obtain the information they used? Address the vulnerability.
The 24-48 Hour Window
Recovery chances drop dramatically after 24-48 hours. Once funds move through multiple accounts or convert to cryptocurrency, they're typically unrecoverable. Acting within hours—not days—is essential. Have bank contact information and reporting procedures documented before you need them.
Post-Incident Actions
Root Cause Analysis
Understand how the attack succeeded. Were verification procedures followed? Was an email account compromised? What information did attackers have? Use findings to strengthen defenses and prevent recurrence.
Employee Support
Employees who processed fraudulent transfers often feel terrible. Provide support, not blame. BEC attacks are designed to fool trained professionals. Focus on process improvement, not punishment.
Process Strengthening
Update verification procedures based on lessons learned. Provide additional training. Consider whether technical controls could be improved. Every incident is an opportunity to strengthen defenses.
Emergency Contact List
Have This Information Ready
Don't search for contact information during a crisis. Maintain a current list of emergency contacts.
Include: Bank wire fraud department phone number (not general customer service), FBI IC3 website (ic3.gov), Cyber insurance carrier claims hotline, Legal counsel contact, IT security team contact, Executive decision-maker for urgent response
Insurance Coverage for Social Engineering
Standard crime insurance and basic cyber policies often don't cover BEC losses. Because the victim voluntarily transfers funds—even though induced by fraud—traditional policies may exclude the loss. Specific social engineering coverage is essential for meaningful protection.
Coverage Types
Social Engineering Fraud Coverage
Specifically covers losses from fraudulent instructions that induce employees to transfer funds or assets. This is the coverage you need for BEC attacks. Often available as an endorsement to crime or cyber policies. Essential for BEC protection
Computer Fraud Coverage
Covers losses from unauthorized computer access or manipulation. May or may not cover BEC depending on policy language—coverage disputes are common when the attack involves email manipulation rather than direct system access. Review policy language carefully
Funds Transfer Fraud Coverage
Covers fraudulent transfer instructions, but policy definitions vary. Some policies require the instructions to result from unauthorized system access. Others cover any fraudulent instruction regardless of method. Definitions matter
Key Coverage Considerations
| Factor | What to Look For | Why It Matters |
|---|---|---|
| Sublimits for social engineering vs. full policy limits | Many policies cap social engineering at lower sublimits | |
| Required controls to maintain coverage | Some policies require callback verification for coverage to apply | |
| Which senders trigger coverage (executives, vendors, clients) | Some policies only cover impersonation of certain parties | |
| Deductibles or waiting periods before coverage applies | Smaller losses may fall below coverage thresholds | |
| Timeframes for reporting losses | Late notification can jeopardize coverage |
First Underwriters Can Help
Social engineering coverage varies significantly between insurers and policies. First Underwriters helps you understand your current coverage, identify gaps, and find policies with robust BEC protection. We work with carriers who offer meaningful social engineering limits and understand modern threats. Contact us to review your coverage.
Get the Right Coverage for Wire Fraud
BEC and wire fraud represent the most common and costly cyber losses for many businesses. First Underwriters Insurance Brokers helps organizations across the Pacific Northwest protect against these threats.
We can help you: Review your current policies for social engineering coverage gaps, find insurers offering adequate social engineering limits, understand verification requirements that may affect coverage, implement procedures that both prevent attacks and support coverage, and respond effectively if a BEC attack succeeds. Contact us to discuss your coverage needs.