Mission 19
Business Email Security and Payment Fraud Prevention
Business email compromise tricks people into sending money to the wrong account. This mission shows how to verify bank-detail changes through a known number, use dual approval, spot urgency and secrecy, and act fast if money has already gone.
In this mission you will
- Recognise common forms of business email compromise, including changed bank details, fake invoices, payroll changes and urgent transfer requests.
- Verify any new beneficiary or bank-detail change using a contact method already held in trusted records.
- Apply dual approval and separation of duties to supplier and payment changes.
- Take the right first steps quickly if a fraudulent payment may have been sent.
When the email looks completely normal
Business email compromise, often called BEC, is a fraud where someone pretends to be a supplier, customer, owner or senior manager to get money or sensitive information. The email may come from a look-alike address, or from a genuine account that has been taken over. It often has no suspicious link or attachment at all. It simply asks for something that sounds routine: 'Please use our new bank account for this invoice.' That is why BEC is hard to catch by looking at the email alone. The strongest defence is a payment process that does not depend on the email being genuine.
Common forms of BEC
- Changed bank details: a supplier appears to say their account has changed and asks you to pay the next invoice to a new account.
- Fake or altered invoices: an invoice arrives that looks real, but the account details or amount have been changed.
- Payroll changes: an employee appears to ask HR to send their salary to a new account.
- Urgent transfer requests: the owner or a director appears to ask for a quick, confidential payment while they are travelling or in a meeting.
- Customer-side fraud: your own customers receive fake emails, seemingly from you, asking them to pay a different account.
The independent call-back
- 1Pause. Do not change any bank details or make a payment based on the email, WhatsApp message or letter alone.
- 2Find the supplier’s phone number in your own trusted records, such as an old purchase order, the vendor master file or a contract. Never use the number, link or contact given in the request.
- 3Call that known number and speak to a person you have dealt with before. Ask them to confirm the change in their own words, without reading the new details out to them first.
- 4If the request appears to come from the owner or a director, confirm it by calling their known mobile number or speaking in person.
- 5Record the call-back: date, who called, who was spoken to and the outcome. Do not record full account numbers or passwords in this log.
- 6Only then pass the change to a second person for approval.
Dual approval and separation of duties
No single person should be able to both add a new beneficiary and release a payment to it. One person enters or requests the change. A second person checks the call-back record and approves. In a very small business, the second person may be the owner. Many banks let you set up maker-checker approval, payment limits and alerts for new beneficiaries on business accounts; ask your bank what options are available. These steps feel slow at first, but they quickly become routine, and they protect staff as much as the business. Nobody wants to be the only person standing between a fraudster and the company’s money.
Protect the mailbox too
Many BEC frauds start with a real email account being taken over, so the fraudster can read conversations and send requests at exactly the right moment. Turn on MFA for every email account, especially accounts, purchase and the owner’s mailbox. Ask your IT partner to check for unexpected forwarding rules and sign-ins. Tell suppliers and customers, in writing, that your bank details will never change by email alone, and invite them to call you on a known number if they receive such a request.
Practical business example
Kaveri Agro Foods pauses before paying
Kaveri Agro Foods, a fictional spice processor in Mysuru, buys packaging from the same supplier every month. One afternoon, the accounts executive Divya received an email from what looked like the supplier’s sales manager. It said their bank had changed due to an audit and asked that a large pending invoice be paid to a new account today, adding that the matter was confidential. The email address looked correct. Divya remembered the company rule: no bank-detail change without a call-back. She found the supplier’s number on an old purchase order and called. The sales manager was surprised. Their bank details had not changed, and they later found their own mailbox had been taken over. Divya logged the call-back, informed the owner, Prakash, and the supplier secured their account. Prakash thanked Divya in the next team meeting.
The lesson: The email came from a genuine but compromised account, so it looked perfect. The process, not the appearance of the email, protected the business. Praising Divya made it more likely others would pause next time too.
Key takeaways
- BEC often looks completely normal, so protect payments with a process that does not depend on the email being genuine.
- Verify every new beneficiary and bank-detail change by calling a number already in your trusted records.
- Use dual approval and separation of duties so no single person can add a beneficiary and release payment alone.
- Treat urgency, secrecy and a new account as reasons to slow down, and thank people who pause to check.
- If money has been sent, contact the bank immediately, call 1930, report at cybercrime.gov.in, inform the owner and keep all evidence.
Scenario lab · +25 XP
New bank account before a big payment
You work in accounts at Shubh Labh Traders, a fictional FMCG distributor in Lucknow with 30 staff. A regular supplier sends an email on a Friday evening, just before a large monthly payment is due. It says their old bank account is under review and asks you to pay to a new account today, so their trucks can be released. It also asks you not to discuss it with others ‘to avoid confusion’. The owner usually approves payments but is at a wedding and hard to reach.
Fictional scenario. Never enter real passwords, OTPs or customer details anywhere in this course.
Decision 1 of 3
What do you do first?
Knowledge check · +20 XP on mastery
Check your understanding
Practical action · +40 XP (self-reported)
Draft a bank-detail change checklist
Create a short checklist your team will use for every new beneficiary or supplier bank-detail change. Keep it general. Do not include real account numbers, passwords, OTPs or customer details.
- 1.Write the rule in one sentence: no bank-detail change or new beneficiary without an independent call-back and a second approver.
- 2.Decide where trusted supplier phone numbers are kept, such as the vendor master file or original purchase orders.
- 3.Set up a simple call-back log with date, request, who called, who was spoken to, outcome and approver, with no full account numbers.
- 4.Name who can approve changes, and a backup approver for when the owner is unavailable.
- 5.Write the emergency steps on the same page: bank’s official fraud number, 1930, cybercrime.gov.in and the owner’s contact.
- 6.Ask your bank about maker-checker approval, payment limits and new-beneficiary alerts, and share the checklist with everyone who handles payments.
Do this in your own records. Don’t enter passwords, OTPs, customer data or incident details here.
Mission status: Not started
A mission is complete when you have read the lesson, answered the knowledge check and acknowledged the practical action. Mastery means scoring at least 3 of 4 on the knowledge check.
View my progress