Business Email Compromise Prevention and Vetting Guide

The surest way to stop business email compromise is a rule no email can override: no payment, and no change to payment details, is ever approved on the strength of an email or a phone number the request supplied. Confirm every instruction by calling a number you already had, and keep a written record of the call. Confirm the other party is who they claim to be and owns what they claim to own. When the counterparty or the instructions cannot be confirmed in house, a licensed investigator can vet them before the money moves.

Business email compromise drew 24,768 complaints and $3,046,598,558 in reported losses to the FBI in 2025, and the FBI's report notes businesses reported losses over $30 million that year to business email compromise schemes involving AI (FBI IC3, 2025 Internet Crime Report). The controls below target the patterns behind those losses, and several of them are the same steps insurance carriers ask about when a claim comes in.

Payment instructions are confirmed by voice, on a number you already had

Treat every request to change bank details as suspect until confirmed, however routine it looks.
Call back on a number from your own records, the signed contract, or the party's official website you looked up yourself. Never use the number in the email, the invoice, the letterhead, or the signature block. In Apache Corp. v. Great American (5th Cir. 2016) the employee did call to confirm. The call went to the number printed on the fraudulent letter.
Ask the person on the call to read the account details to you. Do not read them out for a yes.
Ask for someone you know at the company by name.
Put a holding period on new or changed bank details before the first payment goes out.
Require two people to approve new payees, changed payees, and any transfer above a set amount. The second approver checks the details independently before approving.
Check that the name on the receiving account matches the legal name of the party you owe. A mismatch is a stop.
Treat a new bank in a new country, a personal account for a business payment, or a sudden switch from check or ACH to wire as a stop.
Log every callback: date, time, number dialed, person reached, and what was confirmed. That log is your proof if your insurance policy has a verification condition.

Pressure to pay fast and keep quiet is the warning sign

An executive asking for an urgent, confidential wire outside the normal process is the classic pattern. Confirm in person or on a known number, every time.
Attorneys, title officers, and escrow agents do not change wiring instructions by email at the last minute. Treat any such change as fraud until proven otherwise.
Payroll and direct deposit changes by email get the same callback rule as vendor payments. Our payroll diversion fraud investigation page covers what happens when one gets through.
A message saying "do not call, I am in a meeting" or "keep this between us" is a reason to call.
Deepfake voice and video are now part of these schemes. Treat a familiar voice or face on a call as unconfirmed until a second channel you control confirms the request.

Lock down every mailbox that can move money

Turn on multi factor authentication for every email account, starting with finance, executives, and anyone who can release payments. The FBI recommends multi factor authentication for all services to the extent possible.
Alert on new mail forwarding rules and inbox rules. Attackers use them to hide replies from the real owner.
Tag mail from outside the company so a lookalike of an internal address stands out.
Publish and enforce email authentication records for your domain so others cannot easily send mail that appears to come from you.
Watch for lookalike domains that swap a letter, add a hyphen, or change the ending of your name or your key vendors' names.
Remove access promptly when people leave, and review who can approve and release payments at least twice a year.

Vet the other party before the money moves

Confirm the party as well as the instruction.

Vendors and suppliers

Confirm the business is registered and active with the state where it says it is organized.
Confirm the address, phone, and principals against sources independent of anything the vendor sent you.
Confirm that the bank account belongs to the vendor's legal entity.
Re-vet when a long standing vendor suddenly changes banks, contacts, or remittance addresses.

Real estate sellers and property owners

Confirm the seller is the owner of record in the county's property records, and that the name and mailing address match.
Send a certified letter to the owner's address on the tax record, a step the FBI recommends (Florida Realtors, September 2026).
Be most careful with vacant land, vacation homes, and rentals, properties with absentee owners or no mortgage, and owners recently deceased. In an American Land Title Association survey reported by Florida Realtors in September 2026, 82 percent of title professionals rated vacant land at least a somewhat common target, and 59 percent said their firm saw at least one seller impersonation attempt in the prior year, up from 28 percent in 2024.
Treat a seller who will not meet in person or on video, wants a fast all cash sale below market, asks for a mail-away signing or wants to choose the notary, or keeps everything electronic as a red flag.
Verify the title company, closing attorney, and notary through the state licensing or bar records, and call them on a number you looked up yourself.

Attorneys, escrow agents, and closing parties

Confirm the attorney is admitted and in good standing with the state bar, and that the firm, office, and phone match the bar listing.
Confirm escrow instructions with the escrow holder by voice before every disbursement.

Investors, acquirers, and deal counterparties

Confirm the principals' identities and what they control, and check for any history that should stop the deal. Larger deals call for formal due diligence.

Executives and family offices

Agree a private confirmation phrase or step for any money request outside the normal process, known only to the people who use it.

Insurance readiness belongs in the same program

Many business email compromise claims are lost on policy wording. Before your next renewal, settle these points with your broker:

Which policy carries social engineering coverage, and at what sublimit. Ward and Smith (July 2026) report common sublimits between $25,000 and $250,000.
Whether that coverage depends on a verification condition, such as a callback to a known number, and whether the finance team can prove it follows that step every time.
Whether the condition can be removed or narrowed once you document your controls. Brokers at Amwins advise avoiding or restricting callback and authentication provisions where possible (Amwins, November 2024).

Keep the callback log and the dual approval records. Those records also prove the verification step if a claim is filed. If a claim has already been denied, our BEC insurance claim support page explains the common denial grounds and the forensic record that answers them.

Take these five steps in the first hour after a suspected compromise

Call your bank and ask for a recall of the transfer. The FBI says time is of the essence and advises asking about any indemnification documents the bank requires.
File a complaint at ic3.gov with full transaction details, whatever the amount.
Preserve the evidence. Do not delete the emails, the mailbox, or the logs, and do not reset devices.
Notify your insurance broker and check your policy's notice requirement.
Call a licensed forensic examiner. Our business email compromise investigation page covers what happens next; diverted vendor payments are covered on our vendor invoice fraud investigation page and closing wires on our real estate and title wire fraud page.

Have it vetted before you wire

When a payee, a seller, a counterparty, or a change in payment instructions cannot be confirmed in house, send it to us before the money moves. A licensed examiner confirms the party's identity, what they own or control, and that the account and instructions match, then gives you a written answer. For businesses that pay vendors every week, our vendor payment verification program does this as a standing service. For a new partner, investor or acquisition target, a full due diligence investigation unwinds who owns and controls the other side.

Call (877) 732-6648 and say you need something vetted before a payment.
Email info@e3intel.io. Forward the payment request as an attachment so the original message details are kept, and include the contract or invoice.
Use the "Tell us what happened" form at the bottom of this page.
Schedule a discovery call from our contact page for a standing vetting arrangement.

You receive a written flat fee quote before any work starts.

Book a Confidential Consultation

E3 Legacy Intel is a licensed investigative agency (Florida A-1400197). We are not a law firm, a bank, or an insurer. Nothing on this page is legal, banking, or insurance advice. Confirm coverage questions with your broker and legal questions with counsel.

The one page checklist for everyone who releases payments

Questions finance teams ask before the next wire goes out

What is the single best defense against business email compromise?

A rule that no payment or change to payment details is approved on an email alone, enforced by a callback to a phone number you already had and logged every time. Losses happen when that step is skipped or the callback goes to a number the fraudster supplied.

How do I verify wiring instructions safely?

Call the party on a number from your own records, the signed contract, or a website you looked up yourself, never from the email or invoice. Have them read the account details to you, confirm the account name matches their legal name, and log the call. When a vendor's bank details changed and the money has already moved, the work becomes a vendor invoice fraud investigation.

How can I confirm a seller really owns the property?

Check the county property records for the owner of record and mailing address, send a certified letter to the tax record address, and insist on meeting in person or on video with identification. Vacant land, vacation homes, rentals, and properties with absentee owners are the most targeted. If anything does not match, stop and have the seller vetted before closing.

What are the red flags of a fraudulent vendor bank change?

A request by email, urgency or secrecy, a new bank or a new country, an account name that does not match the vendor, a change of contact person, and pressure to skip the normal process. Any one of them is a reason to call the vendor on a number you already had. The same signs show up when someone asks HR to change an employee's direct deposit, a pattern we investigate as payroll diversion fraud.

Does following these steps help with insurance?

It can. Some social engineering coverage depends on proof that a verification step, such as a callback, was followed. A logged callback and dual approval records are the evidence. Ask your broker what your policy requires. If a claim has already been denied, see our BEC insurance claim support page.

Can E3 vet a counterparty before we send money?

Yes. Send us the party, the instructions, or the transaction by phone at (877) 732-6648, by email at info@e3intel.io, through the form on this page, or by booking a discovery call. A licensed examiner gives you a written answer on whether the party is who they claim and controls what they claim.

What if we already sent the wire?

Call your bank and request a recall immediately, file at ic3.gov with the full transaction details, preserve the emails and logs, notify your broker, and call a licensed forensic examiner. Speed decides whether money can still be frozen.

Business Email Compromise Prevention and Counterparty Vetting Guide