Prevent business email compromise with layered email authentication, phishing-resistant multi-factor authentication (MFA), verified financial controls, and rapid incident response. No single control stops a determined attacker, but SPF, DKIM, and DMARC combined with MFA, dual-approval payment rules, and fast reporting to your bank and the IC3 stop most losses before wire transfers clear.
TL;DR:
- Implement SPF, DKIM, and DMARC in monitoring mode before enforcement to prevent legitimate emails from bouncing, and review reports for at least two weeks.
- Use phishing-resistant multi-factor authentication with hardware keys or authenticators instead of SMS codes, especially on accounts with email access.
- Require dual approval and voice verification for high-value wire transfers, along with fraud flags and short hold periods to catch anomalies early.
- Monitor for suspicious activity like unauthorized mailbox forwarding, odd login times, and unusual IP addresses by integrating logs into your detection system.
- Act quickly within hours of a suspected breach by contacting your bank, preserving evidence, and filing reports to maximize chances of recovering stolen funds.
Table of Contents
- What is business email compromise, and why does it matter?
- What tactics do BEC attackers actually use?
- Practical prevention checklist: immediate and near-term actions
- How do SPF, DKIM, and DMARC actually stop spoofing?
- What identity and access controls actually reduce risk?
- Which financial controls stop fraudulent wire transfers?
- What monitoring and detection signals matter most?
- How should training and policy reduce human error?
- What should you do in the first hours after a suspected BEC incident?
- How does an integrated managed approach close these gaps faster?
- Can cyber insurance cover BEC losses?
- Are there legal requirements around BEC prevention?
- Does BEC hit small businesses differently than large ones?
- A 90-day plan and what actually gets skipped
- How Nexus supports the controls in this guide
- Sources
What is business email compromise, and why does it matter?
Business email compromise (BEC) is a scam where an attacker impersonates a trusted contact, an executive, or a vendor by email to trick an employee into wiring money or handing over sensitive data. The FBI classifies it as one of the most financially damaging categories of online crime, precisely because it relies on social engineering rather than malware that antivirus tools might catch.
The math on recovery is brutal. Once a wire clears and moves through a few intermediary accounts, the money is often gone for good unless someone flags it within hours.
Certain roles get targeted again and again:
- Accounts payable and payroll staff, who move money routinely and rarely question a "policy update"
- Executive assistants, who field urgent requests from leadership and are trained to act fast, not slow down
- HR teams, who handle direct-deposit changes and hold employee banking details attackers want
What tactics do BEC attackers actually use?
BEC operators run a fairly predictable playbook, which is good news: predictable means defensible.
- Reconnaissance. Attackers scrape LinkedIn, press releases, and even out-of-office replies to learn org charts, travel schedules, and vendor relationships. Breached-credential dumps from unrelated data leaks often supply the first foothold.
- Access. From there, they either take over a real mailbox through credential phishing, spoof a vendor's domain, or register a lookalike domain (think "accounts-payable.com" swapped for a single character) that passes a glance test.
- The ask. The email lands with urgency baked in: a payment must move today, a payroll account changed "as of this pay period," or a CEO needs a favour while "stuck in meetings." Authority plus time pressure is the combination that gets bypassed approvals through.
Practical prevention checklist: immediate and near-term actions
Security teams should not wait for a formal project plan to close the obvious gaps. Several of these take a single afternoon.
- Turn on SPF, DKIM, and DMARC, start in monitoring mode, review the reports, then move to enforcement once legitimate senders are confirmed.
- Require phishing-resistant MFA (security keys or platform authenticators, not SMS codes) on every account with mailbox access.
- Set payment rules requiring dual approval on transfers and a call-back to a number already on file, never one provided in the email.
- Audit mailbox rules for unauthorized auto-forwarding and lock down external delegate access.
- Route mail through a gateway that rewrites URLs, sandboxes attachments, and detonates suspicious files before delivery.
Pro Tip: Test your DMARC policy in "p=none" reporting mode for at least two weeks before enforcing rejection. Jumping straight to enforcement without reviewing the reports is the single most common reason legitimate invoices start bouncing.
How do SPF, DKIM, and DMARC actually stop spoofing?
These three records work together, and understanding what each one does changes how you read the reports.
- SPF lists which mail servers are allowed to send on behalf of your domain. It catches senders using your domain from unauthorized infrastructure.
- DKIM attaches a cryptographic signature to outgoing mail so receivers can verify the message wasn't altered in transit.
- DMARC tells receiving servers what to do when SPF or DKIM fails, and it generates reports showing exactly who is sending mail claiming to be you. StaySafeOnline recommends monitoring those reports closely before moving to a reject policy.
Beyond authentication, prioritize a gateway with URL rewriting, attachment sandboxing, and data loss prevention (DLP) scanning. For sensitive financial transfers, layer on message-level encryption rather than relying on a general spam filter to catch everything.
What identity and access controls actually reduce risk?
Phishing-resistant MFA is the highest-leverage control on this entire list. TechTarget reports that MFA blocks the vast majority of credential-based account takeovers, but the method matters: SMS and voice codes are vulnerable to SIM swapping, so hardware keys or authenticator apps should replace them wherever email access is involved.
Least privilege matters just as much. Finance and payroll systems should restrict access to the smallest group that needs it, and offboarding needs to be automatic, not a ticket someone forgets to close. Review third-party app consents quarterly. A stale OAuth grant from an app nobody uses anymore is a door nobody's watching, and shared service account credentials should rotate on a schedule rather than sitting static for years.
Which financial controls stop fraudulent wire transfers?
Technical defences buy time, but the money only moves if someone in finance clicks "approve." That makes process controls the last line of defence.
- Require dual approval for any wire transfer above a defined threshold, with the second approver working from a separate channel than email.
- Mandate voice verification for any change to payee details or routing numbers, calling a number already on file rather than one supplied in the request.
- Use your payment platform's fraud flags and build in a short hold period on newly added or edited payees, giving your team a window to catch anomalies before funds settle.
None of this is complicated. It's friction, applied deliberately, at the exact point where attackers are counting on speed.
What monitoring and detection signals matter most?
Watch for the signals attackers can't avoid leaving behind: new forwarding rules created without a ticket, mailbox access at 3 a.m. from an unfamiliar country, and logins from IP addresses that don't match a user's normal pattern. The FBI has specifically flagged auto-forwarding rule abuse as a common way attackers quietly exfiltrate mail after a takeover.
- Feed mailbox and authentication logs into your SIEM or EDR platform so alerts trigger automatically instead of relying on someone noticing.
- Build containment playbooks that disable an account and revoke sessions the moment a rule fires.
- Use DLP and mailbox analytics to catch bulk exfiltration or unusual attachment volume before it becomes a headline.
How should training and policy reduce human error?
Run phishing simulations targeted at finance and HR specifically, since generic company-wide tests miss the payment-change scenarios attackers actually use against those teams. Refresher training should follow any simulation failure within days, not at the next scheduled cycle.
Publish a policy that flatly prohibits using personal email for any official payment or payroll change, and write down the exact verification workflow so no one has to improvise under pressure. The Canadian Centre for Cyber Security recommends limiting how much contact and org-chart detail sits publicly exposed, since that's the raw material reconnaissance runs on.
What should you do in the first hours after a suspected BEC incident?
Speed decides whether money comes back. APWG data confirms that once a fraudulent wire clears past the first few hours, recovery odds drop sharply.
- Pause any pending outgoing payment immediately and call your bank's fraud team directly, providing the transaction reference and destination account.
- Preserve email headers, authentication logs, and call records, then disable the compromised account and remove any forwarding rules before the attacker notices you're onto them.
- File a report with the IC3 and run a post-incident review to find the specific control gap that let this happen.
Acting inside that first window, not the first day, is often the difference between a recoverable incident and a total loss.
How does an integrated managed approach close these gaps faster?
Running email authentication, MFA enforcement, monitoring, and incident response as separate projects across separate vendors creates seams, and seams are exactly where BEC attackers operate. Consolidating monitoring, mailbox hardening, and response under one team shortens the distance between "we see something odd" and "we've locked it down."
AccountNext-Nexus's guides on reducing cyber risk without a dedicated IT team and building an incident response plan for SMBs walk through the same sequencing covered here: authentication first, access controls second, monitoring and response wired in throughout. Realistically, that means 24/7 monitoring, detection tooling, and a response team that already knows your environment before an incident starts.
Can cyber insurance cover BEC losses?
Cyber insurance can offset some financial damage from a BEC incident, but it is not a substitute for the controls above, and most policies come with conditions that catch organizations off guard after a loss.
Many carriers now specifically underwrite "social engineering fraud" or "funds transfer fraud" as a separate rider from general cyber liability, and it's often capped far lower than the main policy limit. A $2 million cyber policy might carry only $100,000 in social engineering coverage, which barely dents a six-figure wire fraud loss.
Insurers increasingly require proof of specific controls, MFA enforcement, dual-approval payment processes, and documented verification workflows, before they'll pay a claim. File a claim without those controls in place, and you risk a denial on the grounds that the loss stemmed from a preventable process failure rather than a covered cyber event.
Treat insurance as the last layer, not the first. It matters for the residual risk you can't fully eliminate: the sophisticated spoof that slips past filters, the employee who gets caught in a genuinely convincing urgency play despite training. Review your policy's sublimits for social engineering fraud specifically, confirm what documentation you'd need at claim time, and check whether the policy requires you to attempt recovery through the bank and law enforcement before it pays out. None of that replaces dual approval on wires. It just softens the landing when every other control has a bad day at once.
Are there legal requirements around BEC prevention?
There's no single federal law in the United States mandating specific BEC controls, but a patchwork of sector and state rules creates real obligations depending on what data and industry you're in.
Healthcare organizations handling protected health information face breach notification duties under HIPAA if a BEC incident exposes patient data, and financial institutions face similar obligations under the Gramm-Leach-Bliley Act. Companies processing payment card data carry PCI-DSS obligations that touch email security indirectly, since cardholder data exposed through a compromised mailbox counts as a reportable event under most acquirer agreements.
State-level breach notification laws add another layer, and most U.S. states now require notifying affected individuals within a defined window if personal information is exposed, though the exact deadline and threshold vary by state. If your organization operates under a cyber insurance policy, contractual obligations to clients or vendors, often baked into service agreements or NDAs, can impose faster reporting timelines than any statute.
The practical takeaway: don't treat BEC prevention as a discretionary security nicety. If you handle health records, payment data, or hold contracts with breach notification clauses, documented controls, MFA, DMARC enforcement, verified payment workflows, aren't just good practice. They're the evidence you'd need to show a regulator or auditor that reasonable safeguards were in place before an incident, which materially affects liability exposure after one.
Does BEC hit small businesses differently than large ones?
Small businesses often lose a much larger share of their operating capital in a single BEC incident than a large enterprise does, simply because they lack the multiple layers of process friction, and the standing IT security staff, that bigger organizations build over years. A $50,000 fraudulent wire barely registers on an enterprise balance sheet; for a 15-person company, it can mean missed payroll.
Large enterprises face a different problem: complexity. More vendors, more subsidiaries, more email domains after acquisitions, and more employees who've never met the "CFO" supposedly emailing them, all widen the attack surface even as bigger budgets fund more layered defences.
The fix isn't identical for both. Small businesses get the most return from the cheapest controls first: MFA, DMARC, and a simple call-back rule for payment changes, because they likely have none of it yet and every dollar of prevention budget needs to stretch. Larger organizations need to focus more on account governance across a sprawling vendor and subsidiary list, plus automated detection, since manual review doesn't scale once you're processing hundreds of vendor invoices a week. Neither business size gets a pass on the fundamentals; they just need to sequence the rollout differently based on what's actually feasible with the team they have.
A 90-day plan and what actually gets skipped
In the first 30 days, enable MFA everywhere, kill external auto-forwarding, and freeze autopay on high-value wires. Days 30 to 90: enforce DMARC, run role-based training, and pipe mailbox telemetry into your SIEM. If your team can't hit that timeline alone, a managed provider accelerates it without the multi-quarter learning curve.
— Nick - Sr. Executive
How Nexus supports the controls in this guide
Every control in this guide, authentication, MFA, verification workflows, monitoring, works better when it's managed as one system instead of five separate vendor relationships. A managed provider consolidates 24/7 threat monitoring, email security hardening, and incident response under a single service agreement, so a flagged forwarding rule or a suspicious login triggers containment without waiting on a ticket to route between teams.
That matters most in the hours right after a suspected compromise, when the difference between a contained incident and a cleared wire transfer is measured in minutes, not days. AccountNext-Nexus's cybersecurity services cover the technical stack outlined here, DMARC monitoring, MFA enforcement, mailbox anomaly detection, and pair it with incident response teams who already understand your environment before anything goes wrong. If your current setup relies on disconnected tools that don't talk to each other, a website security review for public-facing pages is also worth pairing with your email hardening, since attackers pull reconnaissance data from both. Reach out through the Nexus site to schedule a diagnostic and see exactly where your current defences have gaps.
Sources
For deeper detail beyond this guide, the FBI's BEC overview covers attacker patterns directly, while IC3 is where to file a report after an incident. Microsoft's email security overview explains layered defence in more technical depth, and the Canadian Centre for Cyber Security publishes practical hardening guidance worth bookmarking.
- Business Email Compromise - FBI
- Business Email Compromise: What It Is and How to Prevent It
- Internet Crime Complaint Center (IC3)