Understand the business decision the criminal wants to change
Business email compromise targets trust in ordinary business communications. The FBI describes examples involving familiar invoice relationships and requests that redirect payment. For a small business, the practical weakness can be an unchecked change in the instruction: a new beneficiary, a different approval route or an exception that bypasses the person normally responsible for the transaction.
Write down the decision being requested before investigating the email's appearance. Is finance being asked to replace a supplier account, release an urgent transfer or disclose confidential records? Identify the owner of that decision and keep the original approved information separate. A copied signature or familiar invoice format should not be allowed to update the supplier record on its own.
Separate a deceptive instruction from a compromised mailbox
Several explanations can produce a credible-looking business message. Someone may impersonate a contact, abuse a genuine mailbox, reuse exposed correspondence or persuade a legitimate person to forward a fraudulent instruction. These are possibilities to investigate, not conclusions established by the request. Keep the financial hold in place while the technical owner checks the relevant accounts and evidence.
Our evidence map separates what the team observed from what remains unknown. It avoids delaying an urgent bank conversation until the company has proved the attack method. At the same time, it prevents a technical report from claiming an account takeover merely because a message mentioned a genuine invoice. Record the limits of the evidence alongside each operational decision.
| Observation | Immediate business question | Technical question still open |
|---|---|---|
| New payment details | Who independently verified the beneficiary? | Was any mailbox accessed without authorization? |
| Familiar email thread | Does the proposed action match the agreed work? | How was the thread obtained or altered? |
| Message from a known address | Is the requester authorized for this decision? | Do provider records show account abuse? |
| Payment already released | Can the bank stop or recall it? | Which accounts, rules or sessions need review? |
| Confidential records requested | Does the recipient have a legitimate need? | Was information already disclosed? |
Build verification outside the suspicious conversation
The verification route should exist before the sensitive request arrives. Use a contact already established in the supplier or customer relationship, with a documented way to handle an unavailable contact. A replacement phone number or chat address supplied in the questionable message cannot independently confirm that same message. Returning to the familiar thread also keeps the conversation within the disputed channel.
Verification needs to cover the intended beneficiary and the actual change, not simply whether a person sent an email. Separate identity, authority and approval to release funds. A known supplier employee may still lack authority to change the bank account. Record who verified the change, where the trusted contact came from and which authorized person approved the update under the business's own process.
Know what the technical review can establish
When a mailbox may be involved, ask its administrator to review account activity and relevant configuration using current provider guidance. Microsoft's Microsoft 365 response documentation includes session revocation, authentication-method review, application consent and forwarding checks. Those steps belong to a controlled account response. They are not a substitute for a finance owner checking whether a particular payment was authorized.
Preserve useful records before making changes that would obscure the sequence, while allowing urgent containment when required. Document the owner, time and reason for each action. A working mailbox after a password change is not sufficient evidence that every unauthorized access path was addressed. Keep unknowns visible and involve the provider or an appropriate specialist when the needed evidence is unavailable.
Act on money movement without promising recovery
If a transfer was made or payment details were submitted, use a genuine bank or payment-provider contact promptly and explain the suspected fraud. Preserve the transaction reference and payment status. A pending instruction, completed transfer and attempted beneficiary change may require different handling. Do not wait for routine technical support to determine the attacker's identity before contacting the financial provider.
Financial recovery cannot be guaranteed. The business should also check its incident, insurer and reporting responsibilities for the affected countries. A public FBI source describes US reporting options; it is not a universal instruction for every worldwide company. Keep any technical enquiry separate from sensitive bank records until an appropriate secure exchange and a clear scope have been agreed.
Reduce the dependence on a single employee spotting a scam
Keep supplier changes, payment release and technical account ownership understandable to the people who actually handle them. Provide an alternate approver and a route to report uncertainty without penalty. Review whether a shared mailbox or a departing employee's access can silently change sensitive instructions. A rehearsal can test the handoff between finance and the administrator without sending a deceptive message to real staff.
CyberFixCrew is an Israeli cybersecurity company working with businesses worldwide. Our practical Israeli technical knowledge supports scoped business-email, account-access and digital-infrastructure work. We can discuss the technical part of a business concern within the services described here. We do not claim to provide bank recalls, guaranteed fraud recovery, legal determinations or a continuously staffed incident-response service.