How to Prevent and Detect Business Email Compromise

Summary

The guide recommends layered BEC defenses: verify financial requests through trusted channels, use MFA and email authentication, train employees to spot red flags, and monitor identities and mailboxes for suspicious activity.

Key points

BEC relies on targeted social engineering, such as spoofed vendor domains or compromised email accounts, and may evade malware-focused scanners.
Red flags include urgent payment requests, sudden bank-detail changes, off-hours messages, personal email accounts, and unexpected forwarding rules.
Verify payment or credential requests through a separate, previously trusted channel before acting.
Use MFA on email and financial systems, configure DMARC, DKIM, and SPF, and filter lookalike domains and mismatched reply-to addresses.
Provide ongoing employee training and phishing simulations so staff can recognize and report suspicious messages.
Monitor for mailbox forwarding rules, unusual logins, impossible travel patterns, and spikes in failed MFA attempts.
If a BEC attempt is suspected, report it promptly to IT or security; if money may have been lost, notify the bank and other involved parties.

Article Details

Defense Focus: Prevent and detect business email compromise through layered email and identity controls, verification workflows, employee training, and endpoint monitoring.
Detection Methods: Review unusual payment-change or payment-rerouting requests, urgency, off-hours timing, and mismatches with prior vendor instructions.
Monitor executive mailboxes for newly created forwarding rules and other unauthorized inbox rules.
Detect logins exhibiting impossible-travel or location-based anomalies and sudden increases in failed MFA attempts.
Use email filters to block lookalike domains and flag mismatched reply-to addresses.
Use ongoing security awareness training and simulated phishing and social-engineering scenarios to help employees recognize and report suspicious messages.
Data Sources: Email sender and reply-to addresses, message timing, and payment instructions
Mailbox forwarding and inbox rule changes
Identity login locations and authentication events, including failed MFA attempts
Endpoint behavioral detections
Employee reports of suspicious messages
Platforms: Microsoft 365
Google Workspace
Defensive Actions: Require MFA for email and financial systems.
Configure DMARC, DKIM, and SPF correctly; use filters for lookalike domains and mismatched reply-to addresses.
Require approval workflows and independently verify payment or credential-related requests through a known, separate channel.
Provide ongoing security awareness training and phishing simulations, with a clear channel for reporting suspicious messages.
If a BEC attempt is suspected, do not reply, click links, or act on the request; report it to IT or security promptly.
If a compromise or fraudulent payment is suspected, notify the bank, management, and involved parties immediately.
Monitor identities and email for account takeovers, unauthorized logins, malicious inbox or forwarding rules, rogue OAuth apps, and location anomalies.
Use endpoint protection and behavioral detection to identify and remediate credential-harvesting malware or endpoint footholds.