Business email compromise is fraud by impersonation — an attacker poses as your CEO, a vendor, or a lawyer to convince someone to move money or hand over data. There is usually no malware, which is why filters miss it. Defence comes in five layers: authentication (SPF, DKIM, DMARC at enforcement), multi-factor authentication on every account, training that teaches red flags rather than grammar-spotting, a written payment verification protocol, and monitoring for the mailbox rules attackers leave behind.

The layer that stops the expensive attacks is the payment protocol, because it is the only one that works when the email is genuine.

The Scale of the Problem

The FBI's Internet Crime Complaint Center 2025 Annual Report recorded just over $3 billion in BEC losses across roughly 24,700 complaints — second only to investment fraud among reported categories. That works out to an average near $123,000 per reported complaint, and reported figures understate reality, since many organizations never file.

The overwhelming majority of those losses moved by wire transfer or ACH. That matters for your defence: wire fraud is fast, often cross-border, and rarely recoverable once funds pass beyond the first receiving account.

The 2025 report also introduced a dedicated artificial intelligence section for the first time, logging more than 22,000 AI-related complaints and close to $893 million in associated losses. The practical consequence is that older training advice — watch for clumsy grammar, odd phrasing, obvious errors — no longer works. Generated phishing is fluent, contextual, and often researched from your own public information.

What You Need Before Starting

• Admin access to your email platform.

• A list of every domain you own, including defensive lookalike registrations.

• Your current DNS records — check whether SPF, DKIM, and DMARC exist and what your DMARC policy actually says. A free lookup tool will tell you in seconds.

• A named owner for email security. One person, not a committee. Shared ownership means no ownership.

• Your payment approval workflow, written down — even if it is currently a shared document.

Get a baseline before you change anything. Run a simple test so you can measure improvement later. A manual test message from an outside address works if a simulation platform is out of budget.

Step 1: Get DMARC to Enforcement

Attackers spoof your domain to send mail that appears to come from your executives. SPF, DKIM, and DMARC are what stop that.

• SPF lists which servers may send for your domain.

• DKIM adds a cryptographic signature proving a message was not altered.

• DMARC tells receiving servers what to do when either check fails, and reports back who is sending as you.

Publishing a DMARC record is not the same as being protected, and this is where most organizations stall. Valimail's 2026 State of DMARC Report found that 78% of domains now publish a record, but only 42% have reached enforcement — a 36-point gap the report calls the "Enforcement Gap." Enforcement moved only from 35% to 42% across 2025, suggesting many organizations published a monitoring policy to satisfy the Google, Yahoo, and Microsoft sender mandates and stopped there.

The staged path:

1. p=none for two to four weeks. Read the reports. You will find third-party services sending on your behalf — CRM, invoicing, helpdesk, marketing platform — and there will be more than you expect.

2. p=quarantine for another two to four weeks. Failures go to spam rather than being rejected, so a missed sender is recoverable.

3. p=reject. Unauthenticated mail claiming your domain is refused.

Watch the SPF lookup limit. SPF permits a maximum of 10 DNS lookups. Each service you authorize consumes some, and exceeding the limit causes permanent failure rather than graceful degradation.

NevTan Mail includes guided SPF, DKIM, and DMARC setup that generates and verifies each record. For the full mechanics, see why business emails land in spam and how domain authentication fixes it.

Pro Tip: Do not jump to p=reject. You will block your own invoicing platform, and you will find out when a customer says their invoice never arrived.

Step 2: Multi-Factor Authentication on Every Account

Microsoft has reported that MFA blocks over 99.9% of automated account compromise attacks. That qualifier matters — targeted attacks using real-time phishing proxies can defeat weaker factors, which is why the method you choose is not a detail.

Rollout order: admins first, then finance, then executives, then everyone. Track enrolment weekly and target full coverage within 60 days.

Cover everyone. Attackers target accounts payable, HR, and helpdesk staff precisely because they have useful access and attract less scrutiny than executives.

Where MFA is enforced varies. It may live with your email platform, your identity provider, or your SSO layer. Confirm which system owns it rather than assuming it is handled. NevTan Mail supports 2FA and security keys, alongside session-based authentication and role-based access controls.

Step 3: Train for the Red Flags That Still Work

BEC exploits people, not systems, so training has to be specific and recurring. Annual compliance videos are theatre — attackers iterate faster than your slide deck.

Five red flags worth teaching:

• Urgency — "I need this before close of business," "I'm in a meeting, can't take calls."

• Authority — the CEO, CFO, or a vendor's senior contact.

• Secrecy — "Don't discuss this with anyone yet."

• Changed payment details — new bank account, new wire instructions, a "temporary" account.

• Address mismatch — the display name reads correctly while the actual sending address does not.

Note what is missing from that list: spelling and grammar. With AI-generated phishing now fluent and contextual, message quality is no longer a signal. Replace assessment with procedure — verify, do not judge.

Never punish people who fail a simulation. Someone who fears consequences hides a real click, and a concealed compromise is enormously more expensive than an admitted one. Reporting rate is a better health metric than click rate.

Pro Tip: Run a realistic BEC scenario against your finance team quarterly. If someone would have paid it, you have found a process gap on your own terms rather than an attacker's.

Step 4: Write a Payment Verification Protocol

This is the step that stops the losses, and it costs nothing.

Most BEC money leaves at the payment step. An attacker does not need to break anything if they can persuade someone in accounts payable to send a wire to a new account.

Your protocol should require:

• Out-of-band verification for any payment above a low threshold, and for any change to banking details regardless of amount. Call a number you already hold on file — never a number supplied in the message.

• Dual approval for wire transfers and vendor bank changes.

• A cooling-off period for last-minute payment changes. Urgency is the attack, so removing urgency removes the attack.

• Formal vendor onboarding, so new bank details go through a process rather than an email reply.

No exceptions for executives. A protocol that exempts leadership has a hole exactly where attacks are aimed, and BEC runs on manufactured authority.

Why this catches what technology cannot: when an attacker compromises a real vendor's real mailbox and sends a real invoice with altered details, that message passes SPF, DKIM, and DMARC because it genuinely came from that domain. No authentication protocol will flag it. Only a call to a known number will.

Write it down. Train everyone who touches payments. Put a copy where they work. The protocol's real function is giving an employee permission to say no when someone senior is pushing.

Pro Tip: Agree a verbal challenge phrase with your executive team for payment confirmations. It costs nothing and defeats voice cloning, which is no longer hypothetical.

Step 5: Monitor for What Attackers Leave Behind

Compromised accounts leave traces. Most organizations simply are not looking.

• Mailbox forwarding rules. Attackers create hidden rules forwarding copies externally, or auto-deleting replies so the real owner never sees the thread. This is the single most important thing to check, and the most commonly missed step after a password reset — resetting a password does not remove a rule.

• Unusual login locations and impossible travel. Two logins from distant locations within an impossible window.

• New device registrations and permission changes.

• Outbound anomalies. A compromised account sending unusual volume is often the first detectable sign.

Audit forwarding rules quarterly, not just after an incident.

Additional technical controls exist as separate products, and they are worth considering as you grow: link isolation that rewrites URLs for safe checking, attachment sandboxing that detonates files before delivery, and external-sender banners. These generally come from dedicated security platforms rather than your mail provider, so evaluate them as their own purchase.

NevTan Mail includes continuous account monitoring alongside TLS-encrypted connections, role-based admin controls for rapid revocation, and no ads or data selling on any plan.

What an Attack Actually Looks Like

A controller at a mid-sized firm receives a message that appears to come from the CEO. The display name is correct and the signature matches. It describes a confidential acquisition and asks for a wire before end of day.

Three things are off, and she has been trained to notice them. The reply-to address uses a lookalike domain rather than the real one. The language leans hard on urgency. And it asks her not to discuss the matter internally.

She does not reply. She calls the CEO on the number she already has. No such deal exists.

What stopped the loss was not the filter. The message contained no attachment, no malicious link, and nothing for a security product to detect — just a plausible request from a plausible sender. It was stopped by a person who knew the pattern and a process that made verifying normal rather than awkward.

That is the pattern in most BEC cases that end well. The organizations that catch these have people who know what to look for and a protocol that backs them up when they push back.

Choosing Where to Invest First

Industry matters. Real estate, construction, legal, and manufacturing are frequent targets because they move large sums by wire against invoices. If you are in one of these, treat this as a first-tier priority rather than an IT backlog item.

Five Common Mistakes

1. Relying on filters alone. BEC messages often carry no malicious content. Filters are necessary and insufficient.

2. Exempting "low-risk" accounts from MFA. Attackers do not respect your risk labels. Every account is an entry point.

3. Training once a year. Tactics change monthly and awareness decays in weeks.

4. Having no payment protocol. If someone can wire money on the strength of an email, you are one convincing message from a loss.

5. Punishing simulation failures. It teaches people to hide real mistakes, which is the opposite of what you need.

If You Think You Have Been Hit

Speed determines whether money comes back.

1. Call your bank's fraud department immediately and request a recall.

2. File with the FBI's IC3 at ic3.gov straight away, with complete wire details. IC3's Recovery Asset Team can initiate holds on receiving accounts, but only with prompt, complete information. Once funds move past the first receiving account, recovery odds fall sharply.

3. Contact local law enforcement in parallel.

4. Preserve evidence — full message headers, not forwarded copies.

5. Secure the account: reset credentials, revoke active sessions and app passwords, and check for forwarding rules the attacker created.

6. Notify anyone downstream who may be receiving mail from the compromised account.

Write this list down before you need it.

Frequently Asked Questions

What is business email compromise in simple terms? A scam where an attacker impersonates someone trusted — your CEO, a vendor, a lawyer — to trick an employee into sending money or sensitive data. There is usually no malware involved, which is why conventional security tools miss it.

How much does BEC cost companies? The FBI's IC3 2025 report recorded just over $3 billion in losses across roughly 24,700 complaints, averaging near $123,000 per reported incident. Reported figures understate the true total, since many organizations never file.

Can small businesses really be targeted? Frequently, and often preferentially. Smaller organizations have fewer verification controls, less separation of duties, and staff who may hesitate to question someone senior. Much targeting is automated and opportunistic rather than deliberate.

What is the single most effective step? MFA on every account is the highest-leverage technical control. But out-of-band verification for payments is what stops the expensive attacks, because it works even when the email is genuine and every check passes.

How do I know if we have already been compromised? Look for unexpected password reset messages, new mailbox forwarding rules, sent mail nobody wrote, logins from unfamiliar locations, and contacts asking about requests you did not make. If you suspect compromise, reset credentials, revoke sessions, and audit mailbox rules immediately.

Is DMARC enough to stop BEC? No. DMARC stops spoofing of your exact domain. It does nothing about lookalike domains, which the attacker owns and authenticates legitimately, and nothing about mail from a genuinely compromised account. It is one necessary layer.

How often should we run training and simulations? Simulate monthly and refresh formal training at least twice a year. New hires within their first week. Run an immediate refresher after any real incident or near miss. Track both click rate and reporting rate — if neither is improving, the training needs changing, not repeating.

Conclusion

BEC succeeds by exploiting trust and urgency, so the defence has to be layered. Authentication stops attackers wearing your domain. MFA stops them getting into accounts. Verification procedure stops the attacks that defeat both — and those are the expensive ones.

None of this requires enterprise budget. DMARC enforcement is DNS records. A call-back rule is a policy decision. MFA is a configuration change. What they require is someone owning them and following through.

Your email platform is the foundation the rest sits on. NevTan Mail provides business email on your own domain with guided SPF, DKIM, and DMARC setup, TLS-encrypted connections, 2FA and security key support, continuous account monitoring, role-based admin controls, and no ads or data selling on any plan — with 10 mailboxes at 5 GB each free forever.

See what's included, compare pricing, or get started free.

Verification Notes

First: you already have a BEC article

This is the second draft on this exact topic in this batch. The earlier one — "How to Protect Your Company from Business Email Compromise" — covers the same five-layer structure, the same statistics, and the same primary keyword.

Publishing both will split your ranking signal and give you two pages competing for business email compromise protection. Pick one of three routes:

1. Merge. This draft's payment protocol, red-flag list, and monitoring section are stronger. The earlier draft's DMARC/lookalike explanation and first-72-hours section are stronger. One combined article beats either.

2. Differentiate sharply. Keep one as the broad guide and rewrite the other as narrow — "BEC payment verification protocol" or "how to spot CEO fraud" — with distinct keywords.

3. Publish one, drop the other.

I would merge. The two together contain a genuinely strong single article.

The headline statistic was wrong — and it undersold you

"BEC costs companies an average of $50,000+ per incident (FBI IC3 data)"

IC3's 2025 figures are $3,046,598,558 across 24,768 complaints. That is an average near $123,000 — roughly 2.5× the quoted figure. The draft understated your own argument by more than half.

The related claims — "median for small businesses closer to $30,000" and "20–40 hours of investigation per incident" — could not be verified and were removed.

Other statistics corrected

Product claims corrected

What I strengthened

The forwarding-rule check was promoted from a bullet to the most emphasised item in Step 5 and repeated in the incident FAQ. It is the most commonly missed step in BEC response — resetting a password does nothing about a rule that keeps exfiltrating mail.

A first-72-hours section was added, including the IC3 Recovery Asset Team's ability to place holds on receiving accounts when a complaint is filed promptly with complete wire details. The draft mentioned reporting but not the time sensitivity, which is what determines whether funds return.

The AI training point — I added explicit acknowledgment that spelling and grammar are no longer signals, since the 2025 IC3 report's AI section documents fluent generated phishing at scale. The draft's red-flag list was good and correctly omitted grammar; making that omission explicit is worth more than leaving it implied.

What the draft got right

The payment verification protocol is the best version of that section across all sixteen drafts — the threshold rule, dual approval, cooling-off period, formal vendor onboarding, and the challenge phrase are all correct and practical. The five red flags are well chosen. The metrics targets and the "reward reporting, don't punish clicking" stance are right. All kept.