The invoice is expected. The sender’s name is familiar. The only change is a new bank account, explained in a short message near the end of a busy day. That is enough reason to verify the request through a route you already trust, even when the message looks normal.
Business email compromise, or BEC, uses impersonation or compromised accounts to manipulate business activity, often a payment or a change in account information. It may not involve a malicious attachment. Protecting the transaction needs both technical controls and a process that gives people permission to stop and check.
Verify changes outside the requesting conversation
The FBI’s Internet Crime Complaint Center recommends using a secondary channel to verify requests for changes in account information. Call a known contact using a number already on file or another established route. Do not rely on the new phone number supplied inside the suspicious message to verify the message itself.
Source: FBI IC3 guidance on business email compromise
Make that step normal. If your procedure requires a callback, a genuine supplier or executive should expect it. An employee should not have to decide whether a person sounds suspicious enough to justify following the process. Consistent verification also makes the conversation less personal: you are checking a requested change, not accusing a familiar contact.
An account can be real and still be misused
A legitimate mailbox can be compromised. A convincing display name can also hide an unrelated address. Review the sender details, but do not treat a correct address or an existing thread as final proof that the request is authorized. The transaction process still matters when technical filtering has nothing obvious to block.
RIKR has helped contacts recover compromised mailboxes and social accounts and sort out the consequences, including recommendations about communications to customers downstream. That is a reminder that the work can extend beyond regaining access. You also need to understand what was sent, what changed, and who may need a carefully checked update.
Make prevention more than an instruction to be careful
- Require independent verification for bank-detail changes and unusual payment instructions.
- Use appropriate approval separation so one rushed request does not settle the transaction alone.
- Protect important accounts with stronger authentication and review recovery settings.
- Monitor identities and investigate unexpected sign-ins or mailbox activity.
- Make it easy to report a concern without embarrassment, including after a payment or click.
RIKR’s cybersecurity offering brings managed identity protection and SIEM functionality through Huntress, alongside enhanced email protection through IRONSCALES. Those layers can help with visibility and investigation. They do not remove the need for an independently verified payment process, and no filtering service can guarantee every fraudulent request is recognized.
If a payment may have been diverted, act promptly
Contact the originating financial institution immediately using its established fraud-reporting route and explain what happened. The FBI also directs victims to report BEC to IC3. Recovery is not guaranteed. Coordinate with your IT responder and appropriate advisers to secure affected accounts, preserve useful evidence, and assess communications.
If an employee was tricked, get past the shame and secure the situation. A calm, early report is useful. Blame can wait forever; understanding the facts cannot. Keep the reporting route clear and make sure people know that asking for help is the right next move.
Related: session hijacking and identity protection
Related: training employees to recognize and report phishing
Explore RIKR managed cybersecurity
Written by Joshua Price
Back to the blog