Business Email Compromise Prevention for Small Businesses

Business Email Compromise Prevention for Small Businesses

The most reliable way to prevent business email compromise (BEC) is to combine three things: a strict rule that every payment change is confirmed by an outbound phone call, tighter control of your email accounts and domain, and staff who have practiced spotting a fake request. No single tool does it alone, because many BEC attacks involve no malware at all. This guide explains each layer in plain terms, gives you a checklist you can work through this month, and covers what to do in the first hour if money has already left your account.

Key Takeaways

• BEC is fraud built on trust. Criminals impersonate an executive or a vendor, or take over a real mailbox, and ask for a wire transfer or changed bank details.
• Verify every payment instruction and every bank-detail change with an outbound call to a number already in your own records, never one from the email.
• Turn on multifactor authentication (MFA), set up SPF, DKIM and DMARC, and watch for new mailbox rules.
• Split duties so the person who starts a payment cannot also approve it, and run short drills so staff know what a fake looks like.
• If money was sent, call your bank first, then report to the FBI's IC3 or local law enforcement, and keep the original emails.

Table of Contents

• What business email compromise actually is
• Warning signs your team should recognize
• Layer 1: Verify every payment request out of band
• Layer 2: Build controls into how money moves
• Layer 3: Harden your email environment
• Layer 4: Train people and practice
• A BEC prevention checklist you can use this month
• If you suspect an attack or already sent money
• How we help Oklahoma small businesses stop BEC
• Frequently asked questions
• Sources

What business email compromise actually is

The FBI describes BEC as a fraud scheme in which criminals impersonate trusted sources such as executives or vendors to trick employees into transferring funds or disclosing sensitive data. The U.S. Secret Service adds that the scheme targets businesses that use wire transfers, and that criminals often compromise legitimate business email accounts and then send fraudulent transfer instructions from them.

That second part matters for small organizations. The fake email may not come from a strange address at all. It may come from your real vendor's real mailbox, after someone else took it over. That is why "does the sender look right?" is a weak test on its own.

Microsoft notes that BEC scammers research their targets to exploit trust, which makes these messages more precise and harder to detect than mass phishing. A message that mentions your real project, your real vendor and your real office manager by name does not look like spam.

For a broader look at where BEC sits among other attacks, see our overview of the types of business cybersecurity threats in 2026, and our small business guide to business email compromise.

Who gets targeted in a small business

Attackers go where payments are made and approvals are informal. In a typical Oklahoma City metro small business, that means:

• Office managers and bookkeepers who pay invoices and update vendor records.
• Practice administrators at dental and medical offices who handle supplier and lab payments.
• Law firm staff who handle trust account and closing-related transfers.
• Owners and executives, whose names are used to pressure staff ("I'm in a meeting, buy gift cards" or "wire this today").
• Nonprofit finance volunteers, who often work part-time and without a second reviewer.

Warning signs your team should recognize

Train people to look for patterns, not just typos. The Secret Service guidance lists these signals: urgency, unfamiliar domains, unusual language, requests for secrecy, and a requestor who is out of contact. The FBI also lists a requestor who is pressing you to act quickly.

Two more are specific to vendor fraud. Australia's national cyber security agency points to sender domains that do not exactly match the supplier's company name and to unexpected changes to bank details. A domain such as a vendor name with one letter swapped, or with "-inc" added, is the classic example.

A useful habit: when a message combines money, urgency and a request to skip your normal process, stop. Any one of those alone can be innocent. Together they are the pattern. Guidance to banks from FinCEN makes a related point: no single red flag necessarily proves fraud, so look at the request alongside history and circumstances. Your staff should do the same. Compare the request with how this vendor has always billed you.

Layer 1: Verify every payment request out of band

This is the single most valuable control, and it costs nothing. The rule is simple: no payment instruction or bank-detail change is acted on until someone confirms it by phone.

JPMorgan's BEC playbook is specific about how. Callbacks should be outbound calls made by your organization to a known-good number, not inbound calls and not details supplied by the requester. The number comes from your own system of record, such as the signed contract or the vendor file you built when you onboarded them.

A callback procedure that works in a small office

1. Write the rule into a one-page payment policy: any new payee, any changed account number, any change in payment method, and any request over a set dollar amount needs a callback.
2. Look up the phone number in your own records. If there is none, get one from a source you trust, such as the vendor's official website typed in by hand, or a prior signed document.
3. Call and speak to a person who is accountable for the account. Ask them to confirm the old and the new details.
4. Note the date, the name of the person, and the number you called on the invoice or payment record.
5. Only then update the vendor file or release the payment.
6. For internal requests, such as the owner asking for an urgent wire, confirm in person or by calling the owner's known mobile number, not by replying to the email.

Expect pushback the first time. A real vendor will understand. A fake one will push you to skip the call, and that reaction is itself useful information.

Layer 2: Build controls into how money moves

Process controls beat vigilance because they do not depend on anyone having a good day.

• Separate duties. PNC's small business guidance recommends internal controls that ensure the same employee cannot both initiate and approve a financial transaction. In a three-person office, this can mean the owner approves anything the bookkeeper sets up.
• Lock down vendor master data. Limit who can edit bank details, and log every change with who confirmed it.
• Set approval thresholds. Wires and first-time payees get two sets of eyes regardless of amount.
• Use dual authorization at your bank if it is offered for online wires and ACH.
• Know your bank contact. Have a named person and a direct number ready, because speed matters if a payment goes wrong.

PNC also suggests that small businesses, even without enterprise resources, can build a strong defense by prioritizing basic cybersecurity practices and a culture of direct, verbal verification for payment instructions. That matches what we see: the offices that hold up best are the ones where "let me call you back" is normal and nobody is embarrassed by it.

Layer 3: Harden your email environment

The technical layer does two jobs: it makes it harder for criminals to take over your accounts, and harder for them to pretend to be your domain. The FBI's IC3 advises organizations to enable MFA, configure SPF, DKIM and DMARC, and monitor email for anomalies and foreign logins.

Multifactor authentication

A stolen password is how many mailboxes get taken over. MFA means a password alone is not enough. Turn it on for every mailbox, starting with finance staff, executives and administrators. If your team uses Microsoft 365, MFA and conditional access can be set tenant-wide, and our Microsoft 365 support work often begins here. Prefer an authenticator app or security key over text messages where you can.

SPF, DKIM and DMARC in plain language

These three settings live in your domain's DNS records and work together:

• SPF lists the servers allowed to send email for your domain.
• DKIM adds a digital signature so receivers can tell a message was not altered and really came from your domain.
• DMARC tells receiving servers what to do when a message fails those checks, and sends you reports about who is sending as you.

They stop outsiders from sending mail that appears to come from your exact domain, which protects your customers and vendors from fake invoices carrying your name. They do not stop a lookalike domain or a hijacked real mailbox, which is why they sit alongside the other layers rather than replacing them. The Secret Service guidance also lists registering similar domain names, such as common misspellings of yours, so criminals cannot use them. Roll DMARC out in stages, starting in monitoring mode, so legitimate mail is not blocked. We walk through it in 6 steps to roll out DMARC without an IT team.

Watch mailbox rules and flag outside senders

After taking over an account, attackers often create hidden forwarding or delete rules so the real owner never sees the replies. The Secret Service guidance advises IT administrators to monitor or restrict the creation of new email rules in the email server environment. The same guidance recommends flagging emails from unknown domains, so an external sender is visibly marked as external.

If you run Microsoft 365, anti-phishing policies, impersonation protection and alerts for suspicious rules can be configured in Defender. Test changes with a pilot group first; our write-up on Microsoft 365 Defender setup that avoids mail breaks shows how.

Do not rely on antivirus alone

Ireland's National Cyber Security Centre points out that many BEC attacks involve no traditional malware, so antivirus alone is not enough. The attack is a convincing message, not a malicious file. That is why identity protection, filtering and process controls matter more here than endpoint tools.

Layer 4: Train people and practice

Training that works is short, frequent and specific to the jobs people do. The Secret Service checklist calls for educating employees, and also clients and vendors, and for running BEC drills. Here is a lightweight program:

1. Onboarding: every new hire who touches money or vendor data learns the callback rule on day one.
2. Quarterly drill: send a harmless test email that imitates the owner requesting an urgent transfer or a vendor changing bank details. Treat results as coaching, not punishment.
3. Real examples: share anonymized suspicious messages that reached your inbox so staff see what current attempts look like.
4. Social media habits: JPMorgan's playbook cautions employees against sharing job-related details such as roles or projects online, since attackers use them to write convincing spearphishing messages.
5. Tell vendors and clients: let them know you will always confirm payment changes by phone, and that you expect the same from them.

A BEC prevention checklist you can use this month

This list follows the Secret Service's recommended steps: register similar domains, flag unknown domains, monitor email rules, educate staff, confirm payment changes with trusted information, run drills and enable MFA. If you want to see where your office stands against it, our quick readiness check is a quick way to start.

If you suspect an attack or already sent money

Speed is the whole game. The Secret Service guidance for an incident is to contact your bank immediately to try to reverse the wire, report to IC3 or local law enforcement, and preserve digital evidence. In order:

1. Call your bank now. Ask for the wire to be recalled and give the transaction details. Do not wait to investigate first.
2. Report it. File a complaint with the FBI's Internet Crime Complaint Center or contact local law enforcement.
3. Preserve evidence. The Secret Service asks that organizations document and preserve digital evidence, such as the original emails. Do not delete anything, and keep full message headers where you can.
4. Secure accounts. Change all login credentials, starting with the affected mailbox, and review email systems for unauthorized access or new rules, as the same guidance directs.
5. Analyze the damage. Have a cybersecurity professional determine how the attacker got in and whether other accounts or data were exposed.
6. Notify others. Warn the affected vendor or customer through a verified channel. If your records include regulated information, such as patient or client data, talk to your compliance advisor or attorney about notification duties.

Backups also matter when an account takeover leads to deleted or altered data. Our backup and recovery service is built around tested restores, so you know recovery will work before you need it.

How we help Oklahoma small businesses stop BEC

Great Plains Networking provides proactive managed IT support for small businesses in Norman, Moore and Oklahoma City, including law firms, dental and medical practices, accounting firms, real estate offices, manufacturers and nonprofits. For BEC specifically, our cybersecurity services cover phishing and ransomware protection, MFA and email security setup, and our 24/7 monitoring is designed to catch problems such as unusual logins before they disrupt operations. We explain it in plain language, offer same-day response, and do not require long-term contracts.

If you are not sure how exposed your email is, start with a free network assessment. We will tell you what is in place, what is missing, and what to fix first. If you want ongoing coverage, see our managed IT support for small business.

Frequently asked questions

What is the best way to prevent business email compromise?

The strongest single step is mandatory phone verification of every payment request or bank-detail change, using a number from your own records. Pair it with MFA on all mailboxes and SPF, DKIM and DMARC on your domain. Then train staff with short drills so the process becomes habit.

Does DMARC stop BEC attacks by itself?

No. DMARC helps prevent criminals from sending email that spoofs your exact domain, which is valuable. It does not stop lookalike domains or a real account that has been taken over. Use it with MFA, mailbox monitoring and payment verification.

How is BEC different from regular phishing?

Phishing usually goes out in bulk and tries to get a click or a password. BEC is targeted and often has no link or attachment at all, just a believable request that uses real names and real vendors. Microsoft notes these attacks are often harder to detect than mass phishing because the attackers research their targets.

Can a small business recover money lost to BEC?

Sometimes, and speed decides it. Call your bank immediately to request a recall of the wire, then report to IC3 or local law enforcement and keep all original emails. Recovery is never guaranteed, which is why prevention controls are worth setting up first.

Who in my company should be trained on BEC?

Everyone who can pay, approve, or change vendor information, plus anyone whose name is likely to be impersonated, such as the owner or practice manager. Front-desk and administrative staff matter too, since their mailboxes are often the first compromised.

Sources

• Business Email Compromise, FBI
• Preparing for a Cyber Incident: A Guide to Business Email Compromises, U.S. Secret Service
• Business Email Compromise, U.S. Secret Service
• What is Business Email Compromise (BEC)?, Microsoft Security
• Protecting against business email compromise, Australian Cyber Security Centre
• Advisory to Financial Institutions on E-mail Compromise Fraud, FinCEN
• Business Email Compromise (BEC) Playbook, JPMorgan
• Small Business Email Compromise & Spoofing, PNC
• NCSC Guidance on BEC, Ireland
• Cyber Criminals Take Advantage of Email Compromise, IC3

Recommended

• What Is Business Email Compromise? A Small Business Guide
• Business Data Backup Best Practices for Small Business
• Small Business Network Security Benefits in 2026
• IT Mistakes Small Businesses Make (and How to Fix Them)