Business Email Compromise and Wire Fraud: Verification Rules That Stop It
Criminals pose as vendors or executives to redirect payments. Learn how BEC works and the simple call-back and payment-change rules that stop it.
Business email compromise (BEC) is a scam in which a criminal impersonates someone your company trusts, such as a vendor, your CEO, a title company or your accountant, and asks for a payment or a change of bank details by email. The best protection is not a piece of software: it is a written rule that every new payment request and every change to banking instructions is confirmed by phone, using a number you already had on file, before any money moves. This guide explains how the scam works and the verification procedures that stop it.
How business email compromise works
The FBI describes BEC as a sophisticated scam that targets businesses and individuals who make legitimate transfer-of-funds requests. Criminals get into an email conversation through social engineering or by breaking into a real mailbox, then use it to redirect money. Some variations ask for employee personal information instead of money.
Most cases follow one of a few patterns:
- Vendor invoice fraud. A message that looks like it comes from a real supplier says their bank has changed and the next invoice should be paid to a new account.
- Executive impersonation. Someone posing as the owner or CFO asks an employee to send an urgent wire, buy gift cards or "handle a confidential deal" without telling anyone.
- Real estate and closing fraud. Wiring instructions for a closing or deposit are swapped at the last minute, a common concern for title, legal and property businesses in South Florida.
- Payroll diversion. An "employee" asks HR to change where their paycheck is deposited.
- Data requests. An "executive" asks for W-2 forms or employee records.
Why it is so convincing
BEC messages often come from a real, compromised mailbox, so they arrive in the middle of a genuine thread, quote real invoice numbers and use the right tone. When the attacker cannot get into a real account, they register a look-alike domain (one letter changed, or .co instead of .com) or spoof the display name. The FBI also notes that attackers who control a mailbox may create hidden forwarding rules so they can watch the conversation and step in at the right moment.
The warning signs to train for
No single sign proves fraud, but these should trigger the verification procedure every time:
- A change of bank account, routing number or payment method, especially by email.
- Urgency or secrecy: "this must go out today", "do not call me, I am in a meeting", "keep this between us".
- A last-minute change to wiring instructions right before a closing or payment run.
- A refusal to talk by phone or video.
- Small differences in the sender address or domain, which are easy to miss on a phone. Configure mail apps to show the full address, as the FBI recommends.
- A new payee in another country or a personal account for what should be a business payment.
Verification procedures that stop BEC
The common thread in FBI, IC3 and FTC guidance is simple: verify requests outside of email. Turn that into written policy so employees never have to decide on their own whether to "bother" the boss or the vendor.
1. The call-back rule
Any request to send money to a new account, or to change existing payment details, must be confirmed by a phone call to a number you already had before the request arrived: from the original contract, the vendor master file or the company website you typed in yourself. Never use the phone number, link or signature in the suspicious message. The FBI specifically warns not to contact the vendor through the number provided in the email.
2. A written payment-change policy
Put these rules in writing and share them with finance, office managers and anyone who approves invoices:
- Changes to vendor banking details are only accepted on a signed form, never just an email.
- Every change is confirmed by call-back and logged: who called, which number, who confirmed, date and time.
- Changed details trigger a holding period before the first payment goes to the new account, where your cash flow allows.
- Payroll deposit changes are made by the employee through your HR or payroll portal with MFA, not by email.
3. Dual approval for payments
Require two people to approve wires and ACH payments above a threshold you choose, and any payment to a new payee. Most business banking platforms support this. The FBI recommends adding a second verification step for money transfers, particularly large ones.
4. Tell your vendors and clients how you work
Tell your suppliers and customers, in writing, that your company will never change its banking details by email, and ask them to call you if they ever receive such a message. Title, legal and accounting firms often add this notice to email signatures and engagement letters.
Technical controls that make BEC harder
Procedures stop the money; technology reduces how often the scam reaches your inbox.
- Multi-factor authentication on every mailbox, so a stolen password is not enough to take over an account.
- Email authentication (SPF, DKIM and DMARC) on your own domain. The FTC recommends these so receiving servers can check that mail really came from you. They take care to configure without blocking legitimate mail.
- External sender tags that label messages from outside the company.
- Alerts on new forwarding rules and unusual sign-ins in Microsoft 365 or Google Workspace, and a periodic review of mailbox rules, as the FBI suggests.
- Look-alike domain monitoring for names close to yours.
If you think you sent money to a scammer
Time matters. According to the FBI's IC3, act immediately:
- Call your bank right away and ask it to recall the transfer and contact the receiving bank. Policies vary by institution.
- File a complaint at ic3.gov as soon as possible, regardless of the amount. IC3 may help banks and law enforcement freeze funds.
- Secure the mailbox: reset the password, sign out all sessions, check MFA methods and remove unknown forwarding rules.
- Preserve the evidence: keep the original emails with full headers. Do not delete anything.
- Warn the vendor or client whose name was used, by phone, so others are not targeted.
If the attacker got into one of your mailboxes, treat it as a security incident. Review what else that account could reach and whether personal information was exposed, which can bring notification duties.
A one-page checklist for your office
- Written call-back rule for new payees and banking changes
- Known-good phone numbers stored outside email
- Dual approval on wires and new payees
- MFA on every mailbox, including shared and executive accounts
- SPF, DKIM and DMARC configured on your domain
- Alerts for new forwarding rules and risky sign-ins
- Short annual training for finance and front-office staff
- Bank fraud line and IC3 link posted where finance staff can see them
Business email compromise is a people-and-process problem first. The good news is that a few clear rules, applied every time without exceptions, stop most attempts. If you would like help setting up mailbox protections, email authentication and a payment-verification policy that fits how your team actually works, request a free IT assessment. Core Florida IT works with businesses across Miami-Dade and South Florida.
