How to Stop Business Email Compromise: A Payment Verification Playbook for Mid-Market Owners and Operators

How to Stop Business Email Compromise: A Payment Verification Playbook for Mid-Market Owners and Operators

2026-10-20

The takeaway: Business email compromise is a payment-process problem wearing an email costume. The fix isn’t a smarter spam filter. It’s three rules nobody gets to skip: no change to where money goes takes effect because of an email, every change is confirmed by calling a number you already had on file, and a second person approves any payment headed somewhere new. Add a plan for the moment money leaves, because recovery depends on speed.

What business email compromise is, and how much it costs

The FBI defines business email compromise (BEC) as a scam aimed at businesses and individuals who work with suppliers or regularly make wire transfers. Fraudsters compromise email, phone, or video meeting accounts through trickery or hacking, then move the money (FBI IC3 2025 Internet Crime Report).

In 2025, victims filed 24,768 BEC complaints with the FBI’s Internet Crime Complaint Center (IC3) and reported $3,046,598,558 in losses. That’s second only to investment fraud and up from $2,770,151,146 in 2024 (same report). These are reported losses only.

The Association for Financial Professionals (AFP) surveyed 465 U.S. treasury practitioners in January 2026 and released the results April 14, 2026. 74% said BEC affected their organization in 2025 (AFP). AFP says fraudsters mostly pose as vendors or executives asking to change payment instructions. Among organizations under $1 billion in revenue that experienced payments fraud, 48% took a loss, and 24% of those recovered nothing (AFP report highlights).

Step 1: Map every place a payment instruction can change

List the doors first. For most mid-market companies they are:

  • Vendor bank detail changes and new vendor setup
  • “Urgent” payment requests that seem to come from an executive
  • Employee direct-deposit changes
  • Large one-off transfers, like deal closings

For each, write down who can make the change and what proof they need. If the answer is “an email,” that’s your first gap.

Step 2: Make the callback rule non-negotiable

Out-of-band verification means confirming through a different channel than the request used. The FBI’s guidance is specific: verify payment changes in person or with a known phone number (IC3 PSA, April 6, 2020), and use previously known numbers, not the ones in the email request (IC3 PSA, May 4, 2017).

AFP’s report quotes an anonymous respondent’s near miss. Someone posing as a client sent new bank details, and accounts payable “called the number on the email to confirm.” Only a system glitch kept the money going to the real account.

Make the rule concrete:

  • Pull the number from your vendor file or a signed contract, never the request.
  • Confirm the full new account details, not just “did you send this?”
  • Log who called, when, and who answered.
  • Hold the change for a set period (we suggest at least one business day) before the first payment goes out.

Step 3: Require two people for money going somewhere new

The FBI suggests a secondary sign-off by company staff when a vendor’s payment location changes (IC3 PSA, 2017). In practice:

  • The person who edits vendor bank details can’t also release payments.
  • Your banking portal requires dual approval above a set amount and for any new payee.
  • Executives follow the same rule. A CFO who can skip the callback is the one fraudsters will impersonate.

Step 4: Train for pressure, not just bad grammar

The FBI tells businesses to watch for requests for secrecy, pressure to act fast, and sudden changes in how a contact communicates, such as a switch to a personal email address (IC3 PSA, 2017).

Video isn’t proof either. In a case Hong Kong police described in February 2024, a finance employee at engineering firm Arup’s Hong Kong office joined a video call with what looked like the CFO and other colleagues. Police said all of them were deepfake re-creations, and the employee sent about $25.6 million across 15 transactions. Arup confirmed to CNN that “fake voices and images were used” (CNN, May 16, 2024). Same fix: hang up and call back on a number you already have.

Step 5: Tighten the email side

The FBI recommends multi-factor authentication on all email accounts (IC3 PSA, 2020) and registering domains that are close misspellings of yours (IC3 PSA, 2017). Know the limit: AFP found 39% of organizations still receive genuine emails that fraudsters intercepted. A message from a hijacked real account passes sender checks, which is why Step 2 matters more.

Step 6: Plan for the moment money goes out

The FBI’s advice is blunt: “time is of the essence.” Contact your bank right away to request a recall of the funds, then file a complaint at ic3.gov no matter the amount (IC3 PSA, September 11, 2024).

Speed works. In 2025, the IC3’s Recovery Asset Team acted on 3,900 incidents involving $1,163,919,846 in attempted theft and froze $679,013,183, which IC3 reports as a 58% success rate. In one April 2025 case, an Oregon city government office lost more than $6 million to BEC. The receiving account was already frozen from an earlier complaint, so the receiving bank alerted the city’s bank, which recalled the wire (IC3 2025 report).

Put your bank’s fraud line and who makes the call on one printed page.

Five questions for your controller or AP lead this week

  1. Can a vendor’s bank details change on an email alone?
  2. Where does the callback number come from?
  3. Can one person both change a payee and release a payment?
  4. What’s our dual-approval threshold at the bank?
  5. Who calls the bank if a wire goes wrong?

Where outside help fits

A written incident response plan with a leadership tabletop exercise, cyber insurance application support with a control gap list, and vendor risk reviews are part of Yellow Coop’s Secure work (what we do). It comes as virtual advisory, fractional, or interim leadership (how we engage). If your payment controls live in someone’s head, book a 20-minute call.

Internal links: What We Do, How We Engage, CIO vs CTO vs CISO, Track Record, Contact, Insights.

Sources