Business Email Compromise Prevention Guide

Key takeaways

Business email compromise is a fraudster using a fake or hijacked email account to redirect a payment, usually by changing bank details or asking for an urgent wire.

The strongest defense is a payment process: verify every change of bank details by calling a number you already have, and require a second approver.

Microsoft 365 settings such as MFA, blocked external auto-forwarding, forwarding-rule alerts and email authentication make the fraud harder to pull off.

Business email compromise (BEC) is fraud in which someone uses a fake or hijacked email account to trick your staff into sending money to the wrong place. The most reliable way to stop it is a payment process that does not trust email alone: call to verify any change of bank details using a number you already have, and require a second person to approve payments. Microsoft 365 settings then make the fraud harder to start and easier to spot.

Why it matters

BEC is one of the costliest types of cybercrime reported to the FBI. The FBI's Internet Crime Complaint Center (IC3) received 21,442 BEC complaints in 2024, with reported losses of about $2.77 billion. Losses are often a single large payment, such as a vendor invoice, a payroll run or a closing wire, so one successful message can be expensive.

How it works, in plain terms

There are two common versions, and both end with a request to send money somewhere new.

Spoofed or look-alike sender

The fraudster sends email from an address that looks like a vendor, client or executive, often off by one letter or using a similar domain. Nothing in your systems has been broken into.

Compromised mailbox

The fraudster steals a real user's password, often through a phishing page, and signs in. They read real conversations about invoices or closings and then reply in the existing thread, sometimes after creating hidden inbox rules so the real user does not see replies.

The request is usually one of three things: updated bank details for a vendor or client, an urgent wire for a deal or a confidential purchase, or a change to an employee's direct deposit. Pressure to act fast and to keep it quiet is a common feature.

Why some firms are frequent targets

Fraudsters go where large, routine payments are made by email. Accounting firms handle client payments and tax refunds. Real estate, title and escrow firms move closing funds on predictable dates. Law firms handle settlements and trust account transfers. Property managers pay vendors constantly. In each case, a convincing email arriving at the right moment can look entirely normal.

Process controls that stop most attempts

1. Call-back verification: any new or changed bank details are confirmed by phone using a number already on file or from an independent source, never a number in the email.

2. Dual approval: payments over a set amount, and all changes to payee bank details, need a second person to approve.

3. A written change-of-bank-details policy: tell vendors and clients up front that you will never change payment instructions by email alone, and ask them to do the same.

4. A pause for urgency: train staff that pressure, secrecy and last-minute changes are reasons to slow down, not speed up.

5. Staff training: short, regular refreshers on what these requests look like, including real examples with names removed.

6. Client warnings: firms that receive client funds, such as title and law firms, can state in engagement letters and email signatures that wiring instructions are never changed by email.

Microsoft 365 controls that help

Technology does not replace the process, but these settings close the most common doors. Some depend on your plan, so check Microsoft's current documentation for your license.

• Multi-factor sign-in (MFA) for every account, so a stolen password alone is not enough to get into a mailbox.

• Block automatic forwarding to outside addresses in the outbound spam policy. Microsoft recommends choosing On or Off explicitly rather than leaving the default Automatic setting, whose behavior can vary by organization.

• Alerts on suspicious inbox and forwarding rules. Microsoft 365 provides default alert policies, depending on your plan, such as Creation of forwarding/redirect rule and Suspicious email forwarding activity; make sure someone receives and reviews them.

• External sender tagging, which marks messages from outside your organization in Outlook so a look-alike executive address stands out.

• SPF, DKIM and DMARC records for your domain, which help receiving mail systems reject forged mail that claims to come from you.

• Microsoft Defender for Office 365, where licensed, which adds impersonation protection and link and attachment scanning. As of this writing it is included in Business Premium and available as an add-on for other plans.

What to do right away if money was sent

Speed matters, and so does staying calm. The FBI's guidance is to contact your bank immediately and report to IC3.

1. Call your bank's fraud department now. Ask them to recall the payment and to contact the receiving bank.

2. File a complaint at ic3.gov with the transaction details.

3. Preserve evidence: do not delete the emails. Keep the original messages with headers, payment records and any phone notes.

4. Secure the mailbox: reset the password, sign the user out of all sessions, review MFA methods and remove unfamiliar inbox or forwarding rules.

5. Notify your cyber insurance carrier or broker if you have coverage, and contact your attorney about any notification obligations.

6. Warn the affected vendor or client so they can check their own systems.

This is general information, not legal advice. Your attorney and insurance broker can tell you what your specific obligations are.

A worked example

Take a hypothetical 10-person property management company. Its bookkeeper receives an email, apparently from a long-time landscaping vendor, saying the vendor has changed banks and attaching new details. The reply-to address differs by one character. Because the company's policy requires a call-back, the bookkeeper calls the number in the vendor file, and the vendor confirms nothing has changed. The payment goes out to the correct account, and the email is reported.

Common mistakes

• Verifying a bank change by replying to the same email or calling the number in it.

• Leaving MFA off for a shared or accounting mailbox.

• Allowing automatic forwarding to personal email addresses.

• Turning on alerts that nobody reads.

• Waiting a day to call the bank because the team is not sure yet.

How NexJen can help

Our Security Posture & Compliance Assessment reviews your Microsoft 365 settings against the CIS Benchmark and Microsoft Secure Score and gives you written, risk-rated findings. NexJen Essentials clients get a Microsoft 365 security baseline scaled to their plan, including MFA, plus endpoint protection with managed detection and response on covered computers. We cannot write your payment policy for you, but we can make sure the technology supports it.

Common questions

What is business email compromise?

It is fraud in which someone uses a fake or hijacked email account to trick a business into sending money or sensitive information to the wrong place.

Can Microsoft 365 stop BEC on its own?

No. Settings such as MFA, forwarding controls and email authentication reduce risk, but a call-back and dual-approval process is what stops most fraudulent payments.

Who do we report BEC to?

Contact your bank immediately, then file a complaint with the FBI's Internet Crime Complaint Center at ic3.gov.

Is a look-alike domain a sign we were hacked?

Not necessarily. Many BEC attempts use look-alike addresses without touching your systems. A message sent from your real mailbox is a stronger sign of compromise.

Sources

2024 Internet Crime Report (FBI Internet Crime Complaint Center)Business Email Compromise (FBI)Control automatic external email forwarding (Microsoft Learn)Email authentication in cloud organizations (Microsoft Learn)

Want a second look at your email security?

We can review the Microsoft 365 settings that matter most for payment fraud and help you put them in place.

Get help securing Microsoft 365 See our security services

How to Stop Payment and Invoice Fraud by Email (Business Email Compromise)