How to Protect Your Company from Business Email Compromise

NevTan Mail is secure, ad-free business email on your own custom domain, with a built-in calendar, meetings, role-based admin controls, TLS-encrypted connections, and guided SPF, DKIM, and DMARC setup.

Business email compromise is not a niche threat, and it is not slowing down. According to the FBI's Internet Crime Complaint Center 2025 Annual Report, BEC accounted for just over $3 billion in reported losses across roughly 24,700 complaints — the second most financially damaging cybercrime category after investment fraud. The large majority of those losses moved by wire transfer or ACH, which is why they are so often unrecoverable by the time anyone notices.

What makes BEC different from most cyberattacks is that it usually involves no malware, no exploit, and nothing for a scanner to catch. It is a convincing email asking someone to do their job slightly faster than usual.

This guide gives you a layered defense you can start implementing this week.

Protect against BEC by moving DMARC to an enforcement policy, requiring phishing-resistant multi-factor authentication on every account, establishing mandatory out-of-band verification for payment requests, running ongoing simulated phishing training, and building on an email platform with proper authentication support and role-based admin controls. Technical controls stop impersonation; human verification stops account takeover. You need both, because neither covers the other's gap.

What You Need Before Starting

DNS administrative access, since you will be publishing and modifying TXT records for SPF, DKIM, and DMARC. If nobody knows who controls your DNS, resolve that first.

Leadership buy-in, because enforcing MFA and mandating call-back verification are policy changes, not settings. The verification policy in particular only works if executives accept being verified.

An inventory of financial workflows. Who can approve a payment? Who can change vendor bank details? How are those requests verified today? You cannot protect a process you have not mapped.

A baseline of your current posture. Check whether you have a DMARC record at all and what policy it is set to. Free lookup tools will tell you in seconds.

Step 1: Move DMARC to an Enforcement Policy

DMARC tells receiving servers what to do with mail that claims to be from your domain but fails SPF and DKIM checks. Most organizations that have DMARC at all have it set to p=none, which monitors but blocks nothing.

Move through the policies in stages rather than jumping to enforcement:

1. p=none for two to four weeks. Collect reports and identify every legitimate service sending as your domain — your CRM, invoicing tool, marketing platform, helpdesk. There will be more than you expect.

2. p=quarantine for another two to four weeks. Failures go to spam rather than being rejected outright, so a missed sender is recoverable.

3. p=reject. Unauthenticated mail claiming your domain is refused at the gateway.

Rushing to p=reject before your legitimate senders are authorized is the standard way to break your own invoicing. The staged approach exists for good reason.

NevTan Mail includes guided custom-domain setup with SPF, DKIM, and DMARC verification, which removes most of the hand-editing where misconfiguration creeps in. For the mechanics of each record, see our guide to domain authentication and why business emails land in spam.

One important limit: DMARC protects your exact domain. It does nothing about lookalike domains — yourcompany.co, yourc0mpany.com, your-company.com — because those are different domains that the attacker controls and can authenticate perfectly. Anyone telling you DMARC stops lookalike attacks is describing a different protocol. Lookalikes need defensive registration, display-name filtering, and trained employees.

💡 Pro Tip: Point your DMARC rua tag at a mailbox someone actually monitors. The XML aggregate reports are how you spot spoofing attempts against your domain, and they are useless sitting in an inbox nobody opens.

Step 2: Require Phishing-Resistant MFA Everywhere

Multi-factor authentication is the single most effective control against the credential theft that precedes most account-takeover BEC.

Cover everyone, not just executives. Attackers routinely target finance staff, HR, and the IT helpdesk — accounts with useful access and less scrutiny. An attacker inside your accounts-payable mailbox does not need to impersonate the CEO at all.

Choose the factor carefully. Not all MFA is equal:

Modern phishing kits proxy sessions in real time and can capture both a password and a TOTP code. Hardware keys are the meaningful upgrade for anyone who can move money.

Enforce it centrally so it is not optional. Where MFA is managed depends on your setup — it may live with your identity provider or single sign-on layer rather than your mail platform. Confirm which system owns it before assuming it is covered.

NevTan Mail uses session-based authentication with role-based access controls, where Admin and Super Admin roles govern who manages domains, mailboxes, and billing. For the specifics of what the platform enforces, check the security page directly rather than assuming parity with your identity provider.

💡 Pro Tip: Where you can, disable legacy authentication paths that bypass MFA entirely. Note the nuance: app-specific passwords for IMAP are legitimate for one-off tasks like migrating mail to a new provider, but they should be revoked once that job is finished rather than left live indefinitely.

Step 3: Mandate Out-of-Band Verification for Money

This is the control that catches what technology cannot, and if you implement only one thing from this guide, make it this one.

The rule: any request to send a wire transfer, change payment details, update vendor banking information, or buy gift cards must be verified through a different channel than the one it arrived on. A phone call to a number you already had. Not a number in the email signature.

Why it works where DMARC does not. When an attacker compromises a real vendor's real mailbox and sends a real invoice with altered bank details, the email is authentic. It passes SPF, DKIM, and DMARC because it genuinely came from that domain. No authentication protocol will flag it. Only a human calling a known number catches it.

Make it apply to everyone, especially executives. BEC works on manufactured urgency and authority — "I'm in a board meeting, just get it done." A policy with an exception for the CEO has an exception exactly where attacks are aimed.

Set a threshold, and set it low. Every transfer over some modest amount gets a call-back. Attackers calibrate below thresholds they can guess.

💡 Pro Tip: Maintain verified phone numbers for executives, finance staff, and key vendors in a secure internal document. Establish them out of band once, then trust that record rather than whatever a given email claims.

Step 4: Run Ongoing Phishing Simulation and Training

Annual training does not work. Tactics change monthly and awareness decays in weeks.

Baseline first, so you can measure improvement. Then simulate monthly, mimicking real BEC patterns rather than generic phishing: fake invoices, vendor bank-change requests, payroll redirects, executive impersonation, and increasingly, urgent requests referencing real internal context that attackers have gathered from a compromised mailbox.

Coach, don't punish. People who fear consequences hide mistakes, and a hidden BEC click is far more expensive than an admitted one. Recognize the people who report suspicious mail — reporting rate is a better health metric than click rate.

Train for the AI-assisted version. The FBI's 2025 report included a dedicated AI section for the first time, logging over 22,000 AI-related complaints and roughly $893 million in associated losses. The old advice about spotting bad grammar and awkward phrasing is obsolete. Modern BEC is fluent, contextual, and sometimes voice-cloned, which is precisely why verification procedure has to replace intuition. Our overview of how AI is changing the inbox covers both sides of this shift.

Step 5: Build on a Secure Email Foundation

Your provider is the layer everything else sits on. What to require:

• TLS encryption on connections between your team and the service. NevTan Mail encrypts all traffic between your browser and the platform; our guide to email encryption for business explains what that does and does not cover.

• Full SPF, DKIM, and DMARC support, ideally with guided setup, since misconfiguration is the most common cause of both spoofing exposure and deliverability problems.

• Role-based admin controls, so you can separate billing authority from mailbox management and revoke a departing employee's access immediately.

• Your own domain, which is what makes authentication possible at all. This is the prerequisite for every other control here — see business email on your own domain.

• A business model that isn't advertising. Free consumer email funded by profiling is a poor foundation for confidential business correspondence. NevTan Mail runs no ads and sells no data on any plan, including the free tier.

💡 Pro Tip: Ask any prospective provider about outbound filtering, attachment handling, and data retention. Retention matters specifically for incident response — after a compromise, you need to reconstruct what was accessed and sent.

A Composite Scenario

The following illustrates a typical attack pattern rather than a specific company.

A 150-person manufacturer's finance director receives an email appearing to come from the CEO: an urgent wire transfer for a deal closing that afternoon, with new banking details attached. The sending domain is a lookalike registered two days earlier — one character different, invisible at a glance on a phone. The finance director, under time pressure and reading on mobile, initiates the transfer. The funds move offshore within hours.

What actually failed. Not the spam filter — the message contained no links, no attachments with payloads, and nothing to detect. Not DMARC either, since the mail came from a domain the attacker owned and had authenticated correctly. What failed was the absence of a verification step. There was no rule requiring a call-back, so nothing in the process forced a pause.

What changed afterward. They staged DMARC from monitoring to enforcement, which closed off spoofing of their exact domain and gave them visibility into attempts. They defensively registered the closest lookalike variants and added display-name warnings for external senders. They mandated call-back verification for every transfer above a low threshold, with no exception for executives. They rolled out hardware keys for finance and the C-suite. Simulated phishing click rates fell substantially over the following months, and reporting rates rose — the more meaningful signal.

The lesson worth taking. The technical controls hardened their domain, but the control that would have prevented the loss was the phone call. Layered defense is not redundancy; each layer covers a gap the others cannot.

What to Do in the First 72 Hours After an Attack

Recovery is possible, but the window is narrow and it closes fast.

1. Call your bank's fraud department immediately and request a recall. Speed matters more than completeness here.

2. File with the FBI's IC3 at ic3.gov straight away, with full wire details. IC3's Recovery Asset Team can initiate holds on receiving accounts, but only if it has the information quickly. Once funds move beyond the first receiving account, recovery odds drop sharply.

3. Contact local law enforcement in parallel, not afterward.

4. Preserve evidence. Full message headers, not forwarded copies. Do not delete anything.

5. Secure the accounts. Reset credentials, revoke active sessions and app passwords, and check for mail rules the attacker may have created — auto-forwarding and auto-delete rules are standard practice for hiding a compromise in progress.

6. Notify anyone downstream. If a mailbox was compromised, your vendors and clients may be receiving mail from it.

Write this down before you need it. Deciding who to call during a crisis costs you the hours that matter most.

Choosing Your Defenses by Company Size

The three basics — MFA, DMARC enforcement, and a verification rule — stop the overwhelming majority of attacks and cost very little. A well-executed basic program beats a half-implemented advanced one every time.

Five Common Mistakes

1. Trusting spam filters to catch BEC. Sophisticated BEC has no payload to detect. Filters are necessary and insufficient.

2. Protecting only executives. Finance, HR, and helpdesk accounts are frequently the actual targets, being useful and less watched.

3. Believing DMARC covers lookalike domains. It does not, and this misunderstanding is common enough to be dangerous. Add defensive registration and external-sender warnings.

4. Having no response plan. The first hours determine whether funds are recoverable.

5. Treating training as an annual checkbox. With AI-generated messages now fluent and contextual, the "spot the typo" heuristic is dead. Only procedure holds up.

Frequently Asked Questions

What is business email compromise? BEC is a fraud in which attackers impersonate executives, vendors, or partners over email to trick employees into transferring money or releasing sensitive data. It relies on social engineering rather than technical exploitation, which is why it evades most conventional security tooling.

How common is business email compromise? The FBI's IC3 2025 Annual Report recorded roughly 24,700 BEC complaints and just over $3 billion in reported losses, making it the second-largest loss category. Actual incidence is higher, since many cases go unreported.

Does DMARC stop all email spoofing? No. DMARC stops attackers spoofing your exact domain. It does not stop lookalike domains, which the attacker owns and authenticates legitimately, and it does not stop mail sent from a genuinely compromised account. Those require different controls.

What is the single most important step? Out-of-band verification for financial transactions. It is the only control that catches attacks from compromised legitimate accounts, where every technical check passes.

Can small businesses be targeted? Frequently, and deliberately. Smaller organizations tend to have fewer controls and less segregation of duties. MFA and DMARC cost very little and remove most of the automated attack surface.

How does NevTan Mail help with email security? It provides the foundation: business email on your own domain with guided SPF, DKIM, and DMARC setup, TLS-encrypted connections, session-based authentication, and role-based admin controls that let you manage and revoke access centrally. It is ad-free with no data selling on any plan. Note that some controls in this guide — MFA enforcement in particular — may live with your identity provider rather than your mail platform, so confirm where each is owned in your environment.

What should I do if we've already been hit? Contact your bank immediately to attempt a recall, file at ic3.gov with complete wire details so the Recovery Asset Team can act, contact law enforcement, preserve headers as evidence, and secure the affected accounts including checking for attacker-created forwarding rules.

Is AI making BEC harder to detect? Yes. AI-related complaints appeared as a dedicated category in the FBI's 2025 report for the first time, with around $893 million in associated losses. Generated messages are fluent and contextually accurate, and voice cloning undermines phone verification against unknown numbers — which is why you verify against pre-established numbers rather than whatever a message supplies.

Conclusion

BEC succeeds by exploiting trust and urgency, so the defense has to be layered. Authentication protocols stop attackers wearing your domain. MFA stops them getting into accounts. Verification procedure stops the attacks that defeat both, which are the expensive ones.

None of this requires enterprise budget. DMARC enforcement is DNS records. A call-back rule is a policy decision. MFA is a configuration change. What they require is that someone owns them and follows through.

Your email platform is the foundation the rest sits on. NevTan Mail provides business email on your own custom domain with guided SPF, DKIM, and DMARC setup, TLS encryption, role-based admin controls, and no advertising or data selling on any plan — with 10 mailboxes free forever, so you can evaluate it properly rather than against a countdown.

Start with what NevTan Mail includes end to end, read more on email security and phishing protection, or create your account and get your domain authenticated this week.