Why a normal-looking email can be a serious risk
Business email fraud often works because the message looks like part of an ordinary workday. A finance employee may receive what appears to be a supplier’s updated bank details. A payroll administrator may see a request that seems to come from a colleague. A founder may get an urgent message apparently sent by another executive. None of these requests necessarily includes an obvious technical warning. Any third-party account listing should be checked against the provider’s policies and security requirements; readers can review Gmail accounts with app passwords from PVAInfo.
The danger is the decision made after receiving the message. Criminals may impersonate trusted contacts, take advantage of compromised mailboxes, or create lookalike identities to redirect money or sensitive information. Organizations can reduce these risks by combining account protection with clear procedures for verifying unusual requests.
Understand business email compromise without oversimplifying it
Business email compromise, often shortened to BEC, is a category of fraud in which an attacker uses email-related deception to influence a business action. Some incidents involve an actual compromised account; others rely on convincing impersonation. That distinction matters because a legitimate-looking sender name does not guarantee that a request is authorized.
For employees, the most useful question is not whether the email looks professional. It is whether the requested action makes sense and has been verified through a reliable channel. Unexpected secrecy, urgency, changes to payment instructions, and requests to bypass normal checks all deserve extra attention.
Confirm payment changes using independent contact details
Payment-change requests should never be approved solely because they arrive in a familiar email conversation. A business can create a rule requiring verification through an established phone number or a supplier portal already on record. The employee carrying out the check should not rely on a new phone number included in the same request, because that detail may also be fraudulent.
For higher-value transfers, requiring a second authorized approver can further reduce single-person error. The goal is not to slow every routine payment. It is to add a predictable checkpoint when account details or instructions change. Documenting these steps helps staff resist pressure from messages claiming that an exception is urgently needed.
Protect the accounts that attackers would most want
Email accounts belonging to finance staff, executives, administrators, and customer-support leaders often have access to valuable information and relationships. Protect them with unique passwords and multifactor authentication. Where available, consider phishing-resistant methods such as security keys or passkeys for high-risk accounts.
Review recovery details, active sessions, connected apps, and any automatic forwarding rules. Employees should report authentication prompts they did not initiate. When staff leave the business, remove account access promptly. These measures cannot eliminate every impersonation attempt, but they reduce opportunities for an attacker to take control of a genuine mailbox.
Use email authentication as one layer of defense
Organizations that send messages from their own domains should ask their email administrator or provider about SPF, DKIM, and DMARC. These email-authentication technologies can help receiving mail systems evaluate whether a message is authorized to use a domain and how failures should be handled. Correct configuration can make some forms of domain spoofing harder.
However, technical authentication is not proof that every message is trustworthy. Fraudsters may use lookalike domains, compromised accounts, or channels outside email. Businesses should therefore combine domain authentication with staff training and payment-verification procedures. The best defense is layered rather than dependent on a single filter.
Know what to do when a suspicious request is received
If a request seems unusual, stop the requested action and verify it through a known contact route. Employees should preserve the suspicious message and report it using the company’s established process. They should not send more sensitive details simply to test the sender. A quick report gives the organization an opportunity to warn others who may have received similar messages.
If a payment has already been sent or an account may be compromised, time matters. Notify the appropriate financial institution and the internal security or operations lead immediately. Secure affected accounts from trusted devices, review access, and follow the reporting procedures relevant to the organization’s location. Keep a dated record of actions so investigators and managers can understand the sequence of events.
Turn lessons into repeatable business controls
A useful anti-fraud checklist is short enough that employees will remember it. Verify new payment details through an independent channel. Require appropriate approval for unusual transfers. Protect high-risk mailboxes with stronger authentication. Review account permissions and forwarding settings. Practice recognizing suspicious messages without blaming staff who raise concerns.
Organizations should revisit these controls when adding suppliers, changing financial software, or bringing in new team members. A brief quarterly exercise can reveal whether people know whom to contact in a real incident. Business email fraud evolves, but consistent verification and clear ownership reduce the chance that one convincing message becomes an expensive mistake.
Further reading CISA Secure Our World
