Business Email Compromise (BEC) does not always need malware. A convincing message from “your CEO,” a slightly wrong domain, or a hijacked vendor thread is enough to redirect a wire. The loss is measured in bank transfers, not encrypted files.
Common BEC patterns
- CEO/CFO urgency: gift cards, secret acquisition payments, “I am in a meeting—just send it”
- Vendor payment detail changes via email only
- Lookalike domains (rn vs m, extra hyphen, .co instead of .com)
- Thread hijacking after a real mailbox was phished
Process beats technology alone
- Dual control on payments above a threshold
- Out-of-band verification (known phone number) for bank detail changes
- External email banners in Microsoft 365 / Google Workspace
- No exceptions for “the boss said hurry” without a callback
FBI IC3 tracks BEC losses annually—report and research at ic3.gov. FTC phishing overview: recognize phishing scams.
Harden the human layer with two-factor authentication and layered security.
Need help putting this into practice for your business? Contact SabatAge or call (845) 475-8468. We support Hudson Valley and Orange County businesses with practical security and managed IT.
Controls that stop BEC before the wire
Business email compromise thrives on rushed payments and lookalike domains. Process beats product: dual approval for bank changes, out-of-band verification, and staff who know the CFO will never email a secret urgent wire alone.
- Written payment change verification by phone using a known number
- DMARC enforcement on your domains
- MFA on email and finance systems
- Mailbox rules review for auto-forwarding attackers install after a breach
If you want this handled end-to-end—not as another checklist on a shelf—talk to SabatAge Fully Managed IT or call (845) 475-8468. We support Hudson Valley and Orange County businesses with monitoring, security, and practical guidance.
Train finance and executives hardest
BEC scripts target people who can move money or approve vendors. Give finance a laminated card with the verification steps. Role-play one fake vendor bank-change email per quarter. Process memory beats a long policy PDF.
No responses yet