How to Prevent a BEC Attack: 9 Steps to Prepare Your Team for 2027
To help prevent a business email compromise (BEC) attack, verify new payees, bank-detail changes and unusual payment requests through a trusted second channel before acting. Call the intended recipient using a number already held in your records, require a separate approver, and combine these checks with phishing-resistant MFA and email security that evaluates the request and its business context.
Gabrielle Letain-Mathieu Head of Growth · · 5 min read
A BEC attack is an email scam that tricks someone at your company into sending money or sensitive information to a criminal. The email pretends to come from someone you trust: your CEO, a supplier, a lawyer or a colleague.
There's usually no virus and no suspicious attachment. It's just a convincing request. "Please pay this invoice today." "Our bank details have changed." "Can you buy gift cards for a client?"
The FBI's 2025 Internet Crime Report recorded 24,768 BEC complaints and $3.05 billion in reported losses. BEC ranked second to investment fraud by reported losses. For a fuller background, see our complete guide to business email compromise.
How does a BEC scam usually start?
A BEC attempt can begin with a harmless-looking message that asks for a reply. Microsoft observed approximately 10.7 million BEC attacks in the first quarter of 2026. In those observations, generic openers such as "Are you at your desk?" accounted for 82 to 84% of initial contact emails each month. Explicit requests for financial transactions or documents accounted for 9 to 10%.
The criminal wants a reply first. Once you answer, they build a conversation and the request comes later, when you're already engaged and less likely to question it.
So the first step is simple. Treat an unexpected "quick question" from a senior person as a reason to check, not a reason to hurry.
What are the 9 steps to prevent a BEC attack?
Everyone has a part to play. Employees check and report requests, finance controls payments, and IT or security manages account and email protection.
1. Verify new payees and payment changes
Finance, payroll and accounts payable should confirm new payees, bank-detail changes and unusual payment requests by calling the intended recipient on a number already held in approved records. Record who confirmed the request before updating details or releasing funds. The FBI recommends a second channel to verify account changes.
2. Require a second approver
Finance should require separate approval for new payees, bank-detail changes, unusual payment requests and payments above company limits. The second approver should independently check the supporting invoice, payee details and verification record before authorizing the transaction.
3. Pause when a request creates pressure
Everyone should pause when a request combines urgency with secrecy or asks them to bypass the normal process. "Do this before 3pm" and "Keep this between us" deserve extra scrutiny. Follow the verification process even when the request appears to come from an executive.
4. Check the full sender address
Everyone should expand the sender's display name, especially on a phone, and check the full address and reply-to details. A familiar address can belong to a compromised account. Confirm payment changes independently even when the sender and conversation look familiar.
5. Check links and domains before opening
Everyone should look for unexpected domains and small spelling changes in links. Open a trusted bookmark or the company's usual app when checking an account or payment request. Report unexpected login links and requests to enter credentials.
6. Use phishing-resistant MFA
IT and security should prioritize phishing-resistant MFA, such as FIDO2 security keys or supported passkeys, for email, finance and administrator accounts. Staff should use unique passwords and follow the approved sign-in process. Pair account protection with the payment verification steps above.
7. Protect credentials and sensitive records
Everyone should keep passwords and verification codes private. HR, payroll and finance should independently verify requests for personal, tax or payroll information and use company-approved secure channels to share authorized records.
8. Make suspicious messages easy to report
IT and security should provide a report button or another clear reporting route. Employees should pause the requested action and report the message promptly. Managers should encourage questions and thank people who raise concerns, including when a message turns out to be legitimate.
9. Use email security that evaluates intent
IT and security should assess whether email protection evaluates the request alongside sender, relationship and business context. Include payment diversion and requests from compromised supplier accounts in the evaluation. Use detection findings alongside the approval and verification process.
What are the warning signs of a BEC email?
The clearest warning sign is a request to move money or change payment details, especially with time pressure. The table below pairs common red flags with what to do.
Want to see how these scams unfold step by step? Our interactive walk-throughs show a CEO fraud attack and a vendor invoice fraud attack from start to finish.
Why are AI-written BEC emails harder to spot?
AI can help criminals produce polished, personalized messages quickly. Correct spelling and natural phrasing give employees fewer obvious language mistakes to question. Judge the request and its business context when deciding what to do.
The FBI's 2025 report explains that chat tools can create messages that convincingly impersonate a CEO or other officials. Businesses reported more than $30 million in losses to BEC scams involving AI in 2025.
Email authentication also needs context. StrongestLayer's Phishing Genome examined 32,052 detected attacks from April to June 2026. Among the attacks in that sample that reached inboxes, 86% passed SPF, DKIM and DMARC. These checks validate aspects of a message's sending domain and delivery. The 86% figure describes authentication outcomes across the sample and does not establish which messages were AI-written. A message that passes authentication still needs scrutiny when it requests money or sensitive information.
Which teams do BEC criminals target most?
They target anyone who can move money or change records: finance, accounts payable, payroll, HR and executive assistants. In our Phishing Genome Q2 2026 study, just 3.6% of attacks carried 98% of the modeled financial risk. Those were four money-movement types: CEO fraud, vendor invoice redirects, payroll fraud and W-2 fraud.
If you only have time to train one group this quarter, start with the people who pay suppliers and run payroll.
Final Thoughts: If you've already sent money to a scammer?
Call your bank immediately and ask it to recall the payment. Notify your IT or security team at the same time, and file a complaint at ic3.gov with the full transaction details, whatever the amount lost.
In 2025, the FBI's Recovery Asset Team helped freeze approximately $679 million of $1.164 billion in attempted theft across 3,900 financial-fraud interventions. Its reported 58% reflects the share of funds frozen across multiple fraud categories. Preserve email and payment records while security checks for compromised accounts and warns affected colleagues.
FAQ
How can you help prevent a BEC attack?
Verify new payees, bank-detail changes and unusual payment requests through a trusted second channel using independently stored contact details. Require a separate approver, use phishing-resistant MFA and report suspicious messages before acting.
What's something you can set up on your accounts to help stop BEC?
Ask IT to enable phishing-resistant MFA, such as FIDO2 security keys or supported passkeys, and use unique passwords. MFA helps protect email accounts from takeover. Keep verifying payment requests because criminals can also impersonate senders without taking over your account.
How do BEC attacks commonly begin?
They can begin with a short message designed to get a reply before any financial request. In Microsoft's Q1 2026 observations, generic openers such as "Are you at your desk?" accounted for 82 to 84% of initial BEC contact emails each month.
Can a BEC email come from a real email address?
Yes. Criminals can take over a real employee's or supplier's account and use an existing conversation to make a fraudulent request. Verify new payees, bank-detail changes and unusual payment requests independently, even when the address looks correct.
Why are AI-powered phishing emails harder to detect?
AI can produce polished, personalized messages that mimic familiar writing styles. Check the requested action, sender relationship and business context. Verify financial changes through a trusted second channel even when the wording looks professional.
How StrongestLayer helps
StrongestLayer evaluates email intent and context to help detect requests such as payment diversion and unusual bank-detail changes. Its documented architecture produces a per-message verdict before mailbox delivery. When employees question a message, Inbox Advisor provides a plain-language verdict with supporting reasons through Outlook or Gmail.