Sagar Gadaily
Back to Blog
CybersecurityOctober 3, 20264 min read

Business Email Compromise Training for Finance Teams

Business email compromise caused more than $3 billion in reported losses in the US in 2025. Finance teams are the main target. Here is how to design training around the one habit that stops most BEC fraud: verifying payment changes out of band.

Business Email Compromise Training for Finance Teams

Business email compromise (BEC) is a scam in which criminals impersonate an executive, vendor or colleague, usually by email, to trick employees into sending money or sensitive data. Typical versions include a "CEO" requesting an urgent wire transfer, a "vendor" announcing new bank details, or a compromised supplier mailbox sending a real-looking invoice with altered payment information.

It's one of the most expensive forms of cybercrime. The FBI's Internet Crime Complaint Center reported about $3.05 billion in BEC losses from 24,768 complaints in its 2025 report, out of roughly $20.9 billion in total reported cybercrime losses. And because many BEC emails contain no malicious link or attachment, technical filters often miss them. People are the control.

💡
Key takeaways: BEC relies on authority, urgency and secrecy, not malware. The key habit is verifying every payment or banking change through a separate, known channel. Train with realistic finance scenarios, not generic phishing examples. Support the habit with process: dual approval and a written callback rule.

How BEC attacks work

Most BEC attacks follow a familiar pattern:

  1. Research: attackers study org charts, LinkedIn profiles, vendor relationships and out-of-office replies.
  2. Access or impersonation: they compromise a real mailbox or create a look-alike domain (for example, swapping a letter or using a different top-level domain).
  3. Pretext: an urgent, plausible request that bypasses normal process. "I'm in a meeting, need this paid today, keep it confidential."
  4. Payment redirection: funds go to an account controlled by the attacker, often moved again quickly.

AI is making step three easier. The FBI's 2025 report specifically noted BEC losses with a confirmed AI connection, and deepfake voice and video now let attackers back up an email with a convincing "call from the CFO." In 2024, engineering firm Arup confirmed that an employee in Hong Kong was tricked into transferring about $25 million after a video call with deepfaked colleagues.

The one habit to train: verify out of band

If finance staff remember one thing, it should be this: any request to send money urgently, or to change payment details, gets verified through a separate channel you already trust. That means calling a phone number from the vendor master file or company directory, not one in the email, or confirming in person or through an internal chat system the attacker doesn't control.

Everything else in BEC training supports this habit.

A pen resting on a cheque near the amount line, representing payment approval checks. Photo: Money Knack / Unsplash
A pen resting on a cheque near the amount line, representing payment approval checks. Photo: Money Knack / Unsplash

Designing the training

Use scenarios from real finance work

Generic phishing examples don't feel relevant to an accounts payable clerk. Build branching scenarios around their actual decisions:

  • A known vendor emails new bank details two days before a payment run.
  • The "CEO" texts asking for gift cards for a client event, today.
  • A real supplier's email thread suddenly includes a revised invoice with different account numbers.
  • A video call from a senior leader asks to skip approval "just this once."

Each scenario should let learners choose to verify, comply or escalate, and show realistic consequences.

Teach the red flags, briefly

  • Urgency and pressure to skip normal process.
  • Requests for secrecy or to avoid usual approvers.
  • Changes to banking details, especially by email alone.
  • Subtle domain differences or reply-to addresses that don't match.
  • Unusual payment methods like gift cards or crypto.

Practice saying no to authority

The hardest part of BEC is social, not technical. Junior staff need explicit permission, and practice, to pause a request that appears to come from a senior leader. Leaders should say publicly that they will never be annoyed by a verification call.

Back the training with process

Training sticks better when process makes the right behavior the default:

  • A written callback rule for all banking changes, using contact details on file.
  • Dual approval for payments above a threshold or to new accounts.
  • A short hold period for newly changed vendor bank details.
  • A clear escalation path if something feels off, with no penalty for false alarms.

If money has already been sent

Speed matters. Contact your bank immediately to request a recall, and report the incident. In the US, that means filing with IC3; elsewhere, use your national cybercrime reporting service. Make sure finance staff know this procedure in advance, not after the fact.

For the broader picture of AI-enabled impersonation, see my posts on designing deepfake detection training and phishing simulations that teach.

Sources

All Posts