Business email compromise (BEC) is dangerous because an attacker does not need to break every system in a company. If a criminal can convincingly impersonate an owner, employee, client, supplier, or financial contact, a normal business process can be turned into a fraudulent payment.
For small businesses, preventing BEC requires both cybersecurity controls and financial procedures. MFA and email security matter, but so do independent verification, approval rules, and a rapid response plan when money is sent to the wrong account.
What Is Business Email Compromise?
BEC is a fraud scheme in which criminals use compromised or impersonated email identities to manipulate legitimate business transactions. Common objectives include redirecting wire transfers, changing supplier bank details, altering payroll information, obtaining sensitive employee or customer data, or convincing staff to make an urgent payment.
The message may come from a genuinely compromised mailbox or from an address designed to look similar to a trusted one. That is why checking only the display name is not enough.
Why BEC Matters to Small Businesses
Small companies often have short approval chains and employees who perform several roles. A person responsible for accounting may also communicate directly with suppliers, executives, payroll providers, and banks. That efficiency can become a weakness when an attacker creates urgency and impersonates someone the employee already trusts.
The FBI’s Internet Crime Complaint Center has documented BEC as a major source of business fraud losses and warns that the schemes target organizations ranging from small local businesses to large corporations.
Common Business Email Compromise Scenarios
Supplier Bank-Account Change
An employee receives what appears to be a normal message from a supplier announcing new banking details. Future invoices are then paid to the criminal’s account.
Executive or Owner Impersonation
A criminal impersonates a senior person and asks an employee to make an urgent or confidential transfer, purchase gift cards, or bypass normal approval procedures.
Invoice Redirection
An attacker monitors a legitimate conversation and inserts fraudulent payment instructions at the point when an invoice is expected.
Payroll Diversion
An employee identity is impersonated or compromised and payroll is asked to change direct-deposit details.
Sensitive Data Request
Not every BEC attempt immediately asks for money. Criminals may seek payroll records, tax documents, identity information, credentials, or other data that can support later fraud.
1. Require MFA on Business Email
Protect business email accounts with MFA, especially owners, administrators, finance staff, and employees who can approve payments or access sensitive information. CISA recommends strong MFA as an important defense against phishing-related account compromise.
Where practical and supported, prefer phishing-resistant authentication methods. Also protect account-recovery methods so an attacker cannot simply bypass the normal login process.
Our MFA for Small Business guide explains how to prioritize deployment.
2. Independently Verify Payment Changes
A bank-account change should not become valid merely because it arrived by email. Create a verification procedure for changes to supplier accounts, customer refunds, payroll destinations, wire instructions, and other high-impact financial details.
Verify the request through a trusted secondary channel using contact information already known to the business. Do not rely on a phone number included in the suspicious change request itself.
3. Use Approval Rules for High-Risk Payments
For payments above a level appropriate to the business, consider requiring a second person to approve the transaction. The threshold should reflect the company’s cash flow and risk rather than an arbitrary universal number.
Document when an employee is allowed to bypass the normal process. Ideally, urgency from an email should never be enough by itself.
4. Protect Administrator and Financial Accounts
Email is only one target. Apply strong authentication and appropriate access controls to banking, accounting, payroll, cloud administration, domain registration, password managers, and other systems that could help an attacker impersonate the business or move money.
Limit administrator privileges and remove unused accounts promptly.
5. Train Employees Around Real Payment Workflows
Generic phishing awareness is useful, but BEC training should reflect how the business actually works. Employees should practice recognizing unexpected bank-detail changes, urgent executive requests, unusual confidentiality demands, payroll changes, lookalike domains, unexpected MFA prompts, and messages that pressure them to ignore normal procedures.
Employees also need a simple way to report suspicious messages without fear of being blamed for asking.
6. Review Email Security and Account Activity
Depending on the email platform and business needs, review suspicious login alerts, unexpected forwarding rules, unusual mailbox permissions, administrator changes, and other signs that an account may have been accessed or manipulated.
Email filtering and anti-phishing features can help, but no filter should replace payment-verification procedures.
Warning Signs of a BEC Attempt
- A supplier unexpectedly changes bank details.
- An executive asks for an unusual confidential payment.
- The sender discourages normal verification.
- The display name looks correct but the underlying address is different.
- A message arrives from a lookalike domain.
- Payment instructions change late in an existing conversation.
- Payroll information is changed without the normal process.
- An employee receives unexpected MFA prompts.
- A familiar contact suddenly uses unusual wording, timing, or procedures.
What to Do If Money Was Sent to a Fraudulent Account
Speed matters. Immediately contact the financial institution that sent the payment and explain that the transfer may be fraudulent. Ask about its fraud and recall procedures. In the United States, businesses can also report BEC to the FBI’s Internet Crime Complaint Center (IC3).
At the same time, preserve relevant emails and transaction information, notify the person responsible for incident response, secure potentially compromised accounts, contact the IT or security provider when applicable, and follow cyber-insurance notification requirements if the business has a policy.
Do not delete suspicious messages before the evidence needed for investigation has been preserved.
Does Cyber Insurance Cover BEC?
Coverage depends on the policy. Cyber policies, crime policies, endorsements, exclusions, sublimits, and definitions can differ significantly. A business should not assume that every fraudulent transfer is automatically covered.
Review the policy and application carefully and understand any verification or security controls the insurer expects. Our Cyber Insurance Requirements for Small Businesses guide provides additional context.
BEC Prevention Checklist for Small Businesses
- Enable MFA on email and financial accounts.
- Protect administrator accounts and recovery methods.
- Verify bank-detail and payroll changes through a trusted secondary channel.
- Require additional approval for high-risk payments where appropriate.
- Train staff around the company’s real payment workflows.
- Review suspicious mailbox rules and account activity.
- Remove access promptly when employees or contractors leave.
- Document who to contact after suspected fraud.
- Keep bank, insurer, IT, and incident-response contact information accessible.
Frequently Asked Questions
Can MFA stop business email compromise?
MFA can significantly reduce the risk of some account-compromise techniques, but it does not prevent every BEC scenario. Criminals can impersonate addresses, compromise third parties, manipulate users, or target financial procedures. MFA should be combined with independent verification and access controls.
Should we verify every supplier bank change?
Changes to payment destinations are high-impact events and should follow a documented verification procedure appropriate to the business. A trusted secondary channel is an important safeguard.
What is the first action after discovering a fraudulent wire?
Contact the sending financial institution immediately and follow its fraud and recall procedures. Then activate the business’s incident-response, evidence-preservation, account-security, reporting, and insurance processes as applicable.
Protect the Transaction, Not Just the Inbox
The most resilient BEC defense assumes that a convincing fraudulent message may eventually reach an employee. Strong authentication helps protect accounts, but a verified financial process provides another barrier between a deceptive message and lost money.
Continue with our Business Protection hub, review the Small Business Cybersecurity Checklist, or explore Cybersecurity for Accounting Firms for an industry-specific example.
Sources and methodology: This guide was informed by current FBI Internet Crime Complaint Center guidance on business email compromise and CISA phishing and MFA guidance. CyberCostLab focuses on practical small-business controls and does not guarantee that any control will prevent fraud.
Editorial note: This article is general educational information, not legal, insurance, banking, or incident-response advice. Requirements and recovery options vary by organization, jurisdiction, financial institution, and policy.
1 thought on “Business Email Compromise: How Small Businesses Can Prevent Payment Fraud in 2026”