Business Email Compromise: A Prevention and Response Guide for SMBs

Why a familiar email address is not enough

An email arrives from a longtime supplier: “We’ve changed banks. Please use the attached details for this month’s payment.”

The sender’s address looks right. The invoice matches an actual project. The conversation even includes previous messages. Your accounting team updates the banking information and sends the payment.

But the supplier’s mailbox was compromised, and the money goes to an attacker.

This is business email compromise, or BEC: an attack that uses convincing business communications to trick someone into transferring money or releasing sensitive information. Unlike many cyberattacks, it may involve no malware and no suspicious attachment.

For small and medium businesses, preventing BEC requires more than filtering email. It takes secure accounts, independent verification, useful monitoring, and a response plan employees can follow under pressure.

Understand the three common paths into a BEC attack

The differences matter because each attack requires different defenses.

Impersonation without account access

An attacker creates an address that resembles a trusted contact’s address or changes their display name to match an executive.

A message might appear to come from “Maria, CEO” while the underlying address belongs to an unrelated account. Another might use a lookalike domain with an extra letter.

These attacks depend on employees trusting what they see at a glance.

A compromised employee account

An attacker signs into a legitimate company mailbox using stolen credentials, a stolen session, or access granted through a malicious application.

They can read conversations, learn approval processes, and send requests from the real address. They may create inbox rules that hide replies or forward useful messages elsewhere.

A compromised vendor account

The attacker controls a supplier’s mailbox and inserts fraudulent instructions into an existing conversation.

Your own email accounts may be secure, but the payment request still comes from a legitimate external account. This is why account security alone cannot solve BEC.

Make sensitive requests require independent verification

The strongest business-process defense is straightforward: an email cannot authorize its own legitimacy.

Create a written policy covering:

• New vendor banking information or changes to existing details.
• Payroll direct-deposit changes.
• Unusual wire transfers or urgent payments.
• Requests for employee tax records or other sensitive information.
• Changes to the people authorized to approve payments.

For these requests, verify through a separate, trusted channel.

Call a number already stored in your vendor records—not a number included in the new email or attachment. For internal requests, contact the employee using an established company directory or speak in person.

A reply to the suspicious thread is not independent verification. Neither is a phone call to a number supplied by the sender.

Separate verification from approval

For higher-risk transactions, require one person to verify the request and another to approve the payment. Set approval thresholds based on what your business could afford to lose, rather than copying another company’s limits.

Document who was contacted, which trusted number was used, and who approved the change.

In a small company where staffing makes separation difficult, require the owner or another designated leader to review bank-detail changes before the first payment. Have a backup approver so someone’s absence does not become an excuse to bypass the process.

Secure the accounts attackers want most

Start with finance, payroll, executives, and administrators, then extend the same protections across the business.

Use phishing-resistant multifactor authentication

Multifactor authentication adds an important barrier, but methods vary in strength.

Where supported, prioritize phishing-resistant methods such as passkeys or hardware security keys. These are designed to resist fake sign-in pages that capture passwords and authentication codes.

If your organization currently uses approval prompts, enable number matching where available and teach employees to reject and report unexpected requests. Treat this as an improvement, not an equivalent replacement for phishing-resistant authentication.

Also review account recovery methods. A strong sign-in process loses value if an attacker can easily reset it.

Remove unnecessary access paths

Ask your IT team to review:

• Legacy authentication: Disable older sign-in methods that cannot enforce modern security controls, after checking application dependencies.
• Administrator access: Use separate administrative accounts and avoid using them for routine email.
• Shared mailboxes: Grant named users access instead of sharing passwords.
• Departed users: Promptly block access, revoke active sessions, and review delegated permissions.
• Application consent: Restrict who can authorize applications to access company mail and data.

These controls reduce opportunities for attackers to gain access or remain connected after a password change.

Configure email protections without overestimating them

Email authentication helps receiving systems identify unauthorized use of your domain:

• SPF identifies servers authorized to send mail for a domain.
• DKIM adds a digital signature that receiving systems can validate.
• DMARC tells receiving systems how to handle messages that fail authentication alignment and provides reporting options.

Before enforcing a restrictive DMARC policy, inventory legitimate senders, including invoicing platforms, marketing tools, and business applications. Configure and validate those systems so legitimate messages are not unintentionally rejected.

These protections help address direct domain spoofing. They do not stop every lookalike domain, deceptive display name, or message sent from a compromised legitimate mailbox.

Also consider clearly labeling external messages and blocking automatic forwarding to external addresses unless there is an approved business need.

Monitor mailbox behavior, not just suspicious files

BEC often looks like ordinary account activity. An attacker may use a browser and built-in email features rather than malicious software.

Useful monitoring signals include:

• New external forwarding settings.
• Inbox rules that delete or hide finance-related messages.
• Unexpected changes to authentication or recovery methods.
• New mailbox delegates or application permissions.
• Sign-ins that conflict with a user’s normal activity.
• Unusual outbound email volume or sending patterns.

An unfamiliar sign-in location is a reason to investigate, not automatic proof of compromise. Travel, mobile networks, and VPNs can affect location information.

Identity threat detection and response, or ITDR, can help identify suspicious identity activity. A security information and event management system, or SIEM, can bring relevant logs together for investigation.

Endpoint detection and response, or EDR, remains important for device threats, but endpoint protection alone does not cover every cloud-mailbox attack.

Whether monitoring is internal or supported through managed extended detection and response, or MXDR, establish who reviews alerts and who can contain an account. Confirm that the necessary integrations, logging, and permissions are actually enabled.

Give employees a simple response playbook

Employees should not have to diagnose the attack before reporting it. Provide one clear reporting route, such as the helpdesk, and tell staff to flag suspicious requests immediately.

If a payment or account may be compromised:

• Stop the transaction. Pause pending payments and unverified banking changes.
• Contact the financial institution immediately. Use a known number, explain the suspected fraud, and request available recall or recovery actions. Recovery is not assured.
• Notify IT or security. Share the message, affected account, timeline, and actions already taken.
• Contain account access. Authorized responders should block suspicious access, revoke sessions, reset credentials, and review authentication methods.
• Check for persistence. Inspect forwarding, inbox rules, delegated access, and application permissions.
• Preserve evidence. Retain original messages, headers, sign-in logs, and transaction records. Avoid deleting suspicious messages or rules before responders capture relevant details.
• Warn affected contacts through trusted channels. Do not rely on a potentially compromised email thread.

Follow applicable reporting and notification requirements, involving legal counsel and your insurer where appropriate.

Put the basics in place this month

Start with the control that can interrupt fraud even when technology fails: independently verify banking changes.

Then review finance and administrator account security, check forwarding and application permissions, and confirm that mailbox alerts reach someone who can act.

Finally, run a short tabletop exercise: a supplier requests new banking details shortly before a payment deadline. Ask employees to demonstrate verification, escalation, and documentation. Fix any step that depends on guesswork.

Request a free IT assessment

Tech Architech serves small and medium businesses across the USA, with offices in Hillsboro, Oregon, and Chicago, Illinois. Request a free IT assessment to discuss your account-security and monitoring gaps, and how managed IT, ITDR, SIEM, or MXDR could support your BEC defenses.