The three moves that cut business email compromise risk fastest are phishing-resistant MFA on privileged accounts, a fully enforced SPF, DKIM, and DMARC setup, and a strict rule: never change wire or vendor payment details based on an email alone. Add immediate reporting to IC3 and your bank if fraud is suspected, and you have covered most of what actually stops these attacks.
TL;DR:
- Implement phishing-resistant MFA on privileged accounts to prevent credential theft and real-time phishing bypasses, especially for admin and email accounts.
- Fully enforce DMARC after moving it from monitoring to reject mode to reduce domain spoofing and impersonation in email communications.
- Never change wire transfer or vendor payment details based solely on email requests; verify such changes through a confirmed phone call or independent channel.
- Set dollar thresholds requiring additional approval and keep detailed audit trails for all changes to banking or vendor information to prevent wire fraud.
Table of Contents
- Quick prioritized checklist you can run in the next 1-7 days
- Technical controls: identity, email authentication, and gateway defenses
- Verification workflows and financial controls to prevent wire and payment fraud
- Detection and monitoring: spotting account takeover and post-compromise behavior
- Incident response and reporting: prioritized steps after a suspected BEC
- People, training, and culture: practical programs that improve reporting and reduce mistakes
- Ventis Consulting Group perspective: how a managed IT partner implements these controls for SMBs
- Why most BEC advice misses the point
- How Ventis Consulting Group can help stop business email compromise
- Sources
- FAQ
Quick prioritized checklist you can run in the next 1-7 days
Business email compromise moves fast, so your first week matters more than any long-term plan. Start with the accounts most likely to be targeted and work outward.
- Force password resets for finance, executive, and admin accounts, and revoke any active sessions tied to them.
- Turn on MFA for every admin and email account right away, even app-based MFA if security keys are not yet available.
- Check every mailbox for forwarding rules, delegate access, or inbox filters that attackers commonly used to hide their tracks.
- Put a temporary hold or added verification step on outgoing wires above a set dollar amount.
- Gather transaction details now so you are ready to report quickly if something looks wrong.
In order, your first week should look like this:
- Lock down privileged accounts with MFA and fresh passwords.
- Audit mailbox rules and delegate permissions.
- Set a temporary wire verification threshold.
- Brief your finance team on the new hold policy.
- Confirm you have a direct contact at your bank's fraud department.
Technical controls: identity, email authentication, and gateway defenses
Phishing-resistant MFA, meaning security keys built on FIDO2 standards, blocks the credential theft and real-time phishing proxies that bypass app-based codes and SMS. CISA names phishing-resistant MFA the strongest defense against account takeover, and it recommends deploying it for privileged and email accounts first, then expanding from there. Where security keys are not yet in place, number-matching and login alerts on app-based MFA close some of the gap in the meantime.
Single sign-on paired with strong identity policies reduces the number of places an attacker can try to break in. Combine it with device checks or number-matching prompts so a stolen password alone cannot complete a login.
Email authentication closes the spoofing gap that makes BEC convincing in the first place. CISA's phishing guidance lays out a rollout path:
- Start with SPF and DKIM in monitor mode to see what mail is actually sending on your behalf.
- Move DMARC from monitoring to quarantine once you have reviewed the reports.
- Set DMARC to reject once you are confident legitimate mail will not get caught in the filter.
DMARC reports show which servers are sending mail using your domain, which helps you catch both misconfigurations and active spoofing attempts before they reach customers or partners.
Mail gateway features add another layer: URL rewriting, attachment sandboxing, and stripping active content from inbound messages catch threats that authentication alone will not. For organizations without the staff to manage all of this, the same CISA guidance points out that migrating to a managed cloud email provider gives smaller teams built-in patching and anti-phishing protections they would struggle to maintain on their own. Our guide to modern email security covers how these pieces fit together.
Pro Tip: Roll out DMARC in monitor mode for at least two weeks before quarantining anything. Jumping straight to reject without reviewing reports first can block legitimate mail.
Verification workflows and financial controls to prevent wire and payment fraud
Technical controls stop a lot of attacks, but the ones that get through almost always end with a request to change payment details. That is where a verification process, not software, is your last line of defense.
- Always confirm payment-change requests by calling a known phone number on file, never one provided in the email itself.
- Set dollar thresholds that require a second approver or a mandatory waiting period before funds move.
- Use a standard vendor-change form that documents who verified the request and how.
- Keep a clear audit trail for every change to banking or vendor payment information.
NACHA's business email compromise action plan recommends verifying any change to bank account or beneficiary details through a channel independent of the request itself, such as a pre-established phone contact. This single habit defeats the vast majority of payment fraud attempts because it removes the attacker's only communication channel from the verification step.
- Build a relationship with your bank's fraud team before you need one.
- Know what information they will ask for (transaction ID, amount, date, and recipient bank) so you are not scrambling during an active incident.
- Review your vendor payment workflows with your finance team at least once a year.
Platforms built around enterprise payment verification, like Cray's payment operations tools, show how larger organizations are formalizing this exact workflow with structured approval chains.
Detection and monitoring: spotting account takeover and post-compromise behavior
Catching an attacker after they get in matters just as much as keeping them out. Centralized logging paired with EDR, MDR, or SIEM tools flags anomalous logins, newly created mailbox rules, and lateral movement before an attacker reaches the payment request stage.
- Centralize authentication and email logs so analysts can spot patterns across accounts, not just one inbox at a time.
- Monitor for new forwarding rules, unusual export activity, or logins from unfamiliar locations.
- Tune alerts around high-value accounts first so your team is not drowning in low-priority noise.
Decoys add a high-fidelity layer on top of standard monitoring. CISA's guidance on cyber decoys explains that honeytoken files, decoy accounts, and decoy email addresses generate alerts with a low false-positive rate, which speeds up detection of credential misuse and lateral movement. Placing decoys on executive workstations and sensitive shares targets the accounts attackers want most, which keeps the signal clean. Real-time alerting approaches like those described by MOGHQ reinforce the same point: speed of detection changes the outcome of an incident far more than the sophistication of the tool doing the detecting.
Pro Tip: Place one honeytoken file labeled something an attacker would want, like "wire_instructions_master," in a folder no legitimate employee ever touches. Any access to it is a near-certain compromise signal.
Incident response and reporting: prioritized steps after a suspected BEC
Once you suspect a compromise, speed decides whether funds can be recovered. Move through containment, bank notification, and reporting in that order, without skipping steps to save time.
- Contain the account: force a password reset, revoke active sessions and OAuth tokens, and remove any forwarding rules.
- Call your bank immediately and ask about a wire recall or hold on the transaction.
- File a complaint with IC3 and keep a copy of everything you submit.
- Preserve mail logs, authentication logs, and EDR traces in case forensics or law enforcement need them later.
The FBI's IC3 annual reporting notes that prompt reporting gives banking partners and law enforcement the best chance to freeze or recall fraudulent transfers before the money moves further. Waiting even a day can close that window.
- Loop in legal counsel early if the incident involves client data or regulatory exposure.
- Bring in your MDR provider or a local FBI field office if the compromise looks coordinated or involves multiple accounts.
- Document a timeline of events while it is fresh, since this becomes critical for both your bank and any forensic review.
Our breach response checklist walks through log preservation and containment steps in more detail.
People, training, and culture: practical programs that improve reporting and reduce mistakes
Technology stops a lot of attacks, but people still open the door to the ones that get through. Short, frequent phishing simulations with immediate coaching work better than long annual trainings that employees forget within a week.
- Run brief simulations often, and pair any failed test with a quick, non-punitive coaching conversation.
- Add a one-click "report phishing" button to the email client so flagging suspicious messages takes seconds.
- Route every report to a dedicated triage inbox so nothing gets lost.
- Give executives and finance staff extra attention, since they are the accounts attackers target most.
Make the verification steps from your payment workflow a normal part of how the team operates, not an inconvenience to work around. Recognizing employees who catch a suspicious request reinforces the habit faster than any policy memo. Our email security best practices guide covers training cadence in more detail.
Ventis Consulting Group perspective: how a managed IT partner implements these controls for SMBs
Most small businesses can roll out phishing-resistant MFA across their organization in four to eight weeks, paired with a staged DMARC rollout that moves from monitoring to full enforcement. A managed email security solution layered with managed detection and response can help ensure suspicious logins and mailbox changes get caught and acted on quickly rather than discovered weeks later. For smaller IT teams, outsourcing decoy and tripwire deployment can be a practical alternative to building that capability in-house. Our MFA rollout guide and free cyber security assessment walk through what this looks like in practice.
Why most BEC advice misses the point
Most BEC advice treats this as a technology problem, and that is where it falls short. MFA and DMARC stop a meaningful share of attacks, but the ones that cause real financial damage almost always succeed because a human skipped a verification step under time pressure. A convincing email asking for an urgent wire change beats a well-configured mail gateway more often than anyone likes to admit.
If you only do one thing from this guide, make it the out-of-band verification rule for payment changes. It costs nothing, takes five minutes per request, and closes the gap that technical controls cannot. Phishing-resistant MFA and DMARC enforcement matter and deserve real budget, but they protect the front door. Verification workflows protect the part of the business that actually loses money, which is why they deserve equal priority, not an afterthought bolted on after the technical rollout is finished.
— Greg
How Ventis Consulting Group can help stop business email compromise
Running down this checklist alone takes time most business owners do not have, and a managed IT partner can fill this gap for small and mid-sized businesses. Rather than piecing together MFA, DMARC enforcement, and monitoring across different vendors, some managed service providers offer a unified approach handling setup and ongoing monitoring.
- Managed Email Security configures and maintains SPF, DKIM, and DMARC so your domain stops getting spoofed.
- Managed Detection & Response watches for the account takeover signals and mailbox anomalies covered above.
- Managed IT Services and incident response planning give you a documented process before you ever need one.
A cyber security assessment often starts with a review of current email configuration, MFA coverage, and verification workflows, and results in a prioritized action plan. Request your free cyber security assessment to see where your business stands.
Sources
- Phishing Resistant MFA is key to peace of mind | CISA
- Business Email Compromise Action Plan | NACHA
- IC3 2025 Annual Report
FAQ
How to prevent a business email compromise?
Prevention comes down to phishing-resistant MFA on privileged accounts, a fully enforced DMARC policy with SPF and DKIM, and a strict rule that payment changes are verified by phone, never by email reply. These three controls, backed by CISA's phishing guidance, address the most common entry points attackers use.
How do I fix a compromised email account?
Reset the password immediately, revoke all active sessions and OAuth tokens, and remove any forwarding rules or mailbox delegates the attacker may have added. Then review authentication logs for the account to see what else may have been accessed during the compromise.
Who is liable for business email compromise?
Liability depends on your contracts, your bank's policies, and whether reasonable security controls were in place at the time of the incident, so there is no single answer that applies to every business. Reporting promptly to IC3 and your bank gives you the best chance at fund recovery and a cleaner record if liability questions come up later.
Can you give me an example of a business email compromise attack?
A common pattern involves an attacker spoofing or taking over a vendor's email account, then sending an invoice with updated bank details to a company that regularly pays that vendor. If the company pays without verifying the change through a known phone number, the funds go directly to the attacker's account, often before anyone notices.