Business Email Compromise Response: A Playbook for HR, Finance and Leadership

What is business email compromise?

Business email compromise, or BEC, is a form of impersonation and payment or information fraud in which an attacker appears to be a trusted executive, employee, vendor, adviser or business partner. The FBI describes BEC as a sophisticated scam affecting businesses and individuals who transfer funds, often involving compromise of a legitimate email account through social engineering or computer intrusion.

The name can be misleading: the contact may begin through email, but the attacker may continue by text message, telephone, voice memo, collaboration platform or a falsified document. The requested action may be a wire, invoice payment, gift-card purchase, payroll or direct-deposit change, release of tax or benefits data, credential entry, or a confidential task that bypasses normal review.

Compromised account and spoofed identity are different

In an account compromise, an attacker has access to a real mailbox or collaboration account. They may study message history, reply inside an existing thread, create forwarding or deletion rules, maintain active sessions, or impersonate the account owner convincingly. In spoofing or look-alike impersonation, the attacker may use a deceptive display name, altered domain, falsified sender information, personal mailbox, telephone number or synthetic voice without controlling the real account.

That distinction changes the technical response. A spoofed message still requires fraud response and review of how it passed controls, but a confirmed account compromise also requires session revocation, credential and authentication review, mailbox-rule inspection, connected-app review, scoping of accessed content, and assessment of whether other people or systems were affected.

What should an organization do when BEC is suspected?

Use two parallel tracks: stop the business action and investigate the security event. Neither should wait for perfect certainty when a payment, payroll change, credential or sensitive disclosure can still be prevented.

These steps align with the broader employee data breach response-plan guide and the downloadable Employee Data Breach Response Checklist. For time-sequenced incident leadership, use The First 24–48 Hours After a Data Breach.

Give HR, payroll and finance scenario-specific instructions

BEC succeeds when a credible request reaches someone with authority to move money, change records or release information. Controls should protect the action—not depend on an employee noticing one perfect warning sign.

Payroll has both financial and identity consequences

A diverted paycheque is a financial incident for the employee and the organization. If payroll, tax, benefit or identity information was accessed or disclosed, add an employee-support and privacy assessment rather than treating the event only as a payment problem. Benchmark’s employer playbook for supporting employees after personal information exposure explains that separate workstream.

Finance should design controls for changes, not just invoices

Require independent verification for new beneficiaries, changed banking instructions, urgent deviations and executive exceptions. Use segregation of duties, transaction limits and documented approvals that cannot be waived by the person named in the message. Review whether a failed attempt exposed weaknesses in the workflow even when no money moved.

Contain a suspected account compromise without destroying evidence

Qualified IT or security personnel should tailor containment to the environment and preserve material evidence. Typical actions may include disabling or restricting the account; resetting credentials through a trusted administrative path; revoking active sessions, refresh tokens and app passwords; reviewing MFA methods and recent changes; inspecting sign-in, audit and message-trace logs; removing malicious forwarding, inbox or deletion rules; reviewing delegates and connected applications; checking recovery addresses and telephone numbers; and identifying other accounts or devices that may be affected.

Do not assume a password change ends the incident. An attacker may retain an authenticated session, registered authentication method, OAuth grant, forwarding rule or access to another compromised account. Conversely, do not make unsupported claims that an account was compromised merely because its name was spoofed.

Assess business and data exposure separately

Determine what actions were requested or completed, what messages or files may have been viewed, whether personal or confidential information was sent, what systems the account could reach, and whether the attacker contacted others. Build a timeline and distinguish confirmed facts, reasonable indicators, unknowns and ruled-out scenarios.

If employee personal information may have been involved, use Benchmark’s U.S. and Canadian breach-notification decision framework. Notification depends on applicable law and incident facts; a BEC report to law enforcement does not replace privacy or contractual analysis.

Address the human factors without blame

BEC messages commonly exploit authority, urgency, secrecy, helpfulness and fear of delay. Attackers may use familiar names, realistic context, an existing thread or a plausible exception. A blame-focused response discourages fast reporting and hides useful information. Employees should be thanked for pausing or reporting, even when an action was already taken.

Build a culture in which any employee can stop a sensitive transaction, seniority does not cancel verification, and reporting a mistake quickly is safer than concealing it. Training should use job-relevant scenarios and reinforce one clear reporting route. Controls should remain effective when people are busy, travelling or working across time zones.

AI can strengthen impersonation, but process remains the control

Official FBI alerts describe malicious use of AI-generated audio and other synthetic content to make impersonation more believable. That does not mean every convincing call or message is AI-generated, and employees should not be expected to identify synthetic media by intuition alone. Use an established callback, prearranged verification phrase or other independently maintained procedure for sensitive requests.

Do not let an apparent face, voice, writing style or caller ID override payment, payroll or data-release controls. A trusted process remains useful whether the attacker uses a compromised account, a look-alike domain, ordinary social engineering or AI-assisted impersonation.

Use the appropriate U.S. or Canadian reporting route

Usable framework

Benchmark’s BEC response playbook

This eight-step sequence is a Benchmark-created operational framework, not an official government standard or a guarantee of recovery.

For the broader program, connect this playbook to the Social Engineering & Fraud pillar, the employee data breach response plan and the Benchmark Knowledge Center.

Recover the process, not only the account

After urgent actions, confirm whether payments were stopped, recalled, recovered or remain unresolved; whether payroll or vendor records need correction; whether affected people require support; and whether operations can resume safely. Communicate only verified status. Do not imply that filing a report, recalling a payment or restoring an account guarantees recovery.

Hold a structured review covering the initial contact, trust signals, approvals, technical controls, response speed, evidence quality, vendor coordination and employee experience. Convert each lesson into an owner, due date and test. Useful measures include time from message to report, time to payment hold, percentage of sensitive changes independently verified, stale forwarding rules removed, completion of high-risk workflow exercises and closure of corrective actions.

Test realistic scenarios

Run tabletop exercises involving an executive request, vendor-bank change, payroll diversion and possible employee-data disclosure. Include after-hours contacts and a situation in which the apparent requester confirms the transaction through a compromised channel. The exercise should test whether staff can find a trusted contact, stop the action, escalate without blame and preserve a clear decision record.