How to Prevent Business Email Compromise & Stop Bad Actors
Do You Know How to Prevent Business Email Compromise?
Business email compromise is the most expensive fraud scheme targeting finance teams today. The FBI estimates U.S. organizations have lost upwards of $55 billion between 2013 and 2023, and the number keeps climbing. The reason is straightforward: BEC works. Not because it’s technically sophisticated, but because it exploits the normal, routine behavior of accounts payable teams doing their jobs.
Here’s how to prevent business email compromise before it reaches your payment system.
The short answer is this: remove the email inbox as a trusted verification channel for anything that touches vendor payment details. BEC exists because finance teams treat email as authoritative. The prevention controls that actually work are the ones that don’t rely on email.
The rest of this page explains what that looks like in practice, why common responses fall short, and what a durable BEC prevention posture requires.
Learn How to Prevent Business Email Compromise
Take a Self-Guided Demo
What Business Email Compromise Actually Targets
BEC is not random. Attackers go after specific transactions: large vendor payments, banking detail updates, or urgent payments. They target accounts payable specifically because AP teams process high-volume, high-value payments under time pressure, and because vendor payment workflows often rely heavily on email communication.
The two most common BEC scenarios in vendor payment contexts are:
Payment redirection
An attacker impersonates a vendor — usually through a spoofed domain or a compromised vendor email account — and sends a request to update banking details before the next payment. The email looks legitimate. The request sounds routine. Someone in AP processes it. The next payment goes to an account controlled by the attacker.
Vendor impersonation
A fraudulent entity is set up to look like a legitimate vendor. The attacker impersonates a real supplier the organization already works with. Invoices get submitted. Payments get approved. The fraud can run for months before anyone notices.
Both scenarios share the same root vulnerability: the process accepted information at face value, through email, without authenticating who was actually on the other end.
Why Standard Email Security Doesn’t Solve This
Your IT team has likely invested heavily in email security, and it helps — but it doesn’t prevent these scams. Here’s why.
BEC attacks work because it’s your vendor, NOT your organization, that has been compromised. That email your staff receives from legitimate, compromised email accounts, not spoofed domains. When a vendor’s actual email account gets compromised, no spam filter catches the message. The domain is real. The sender’s history is real. The email looks exactly like the hundreds of other messages you’ve received from that vendor. No IT tool has been invented that spots fake information in a real email.
Spoofed domains are getting harder to detect too. Attackers register domains that differ from the legitimate one by a single character, a hyphen, or a transposed letter. Under time pressure, these slip through.
Email security is a necessary layer; however, it’s not sufficient. BEC prevention in the vendor payment context requires controls that don’t depend on detecting a bad email — controls that operate regardless of whether the email that initiated the request was legitimate.
How to Prevent Business Email Compromise: The Controls That Work
Preventing BEC in accounts payable comes down to a set of specific process controls applied at specific moments. These are not exotic. They’re achievable with the right workflow design.
Verify vendor identity before onboarding, not after
Before any new vendor is added to your payment system, their business identity needs to be authenticated against authoritative data sources. Tax ID verified against IRS records. Business registration confirmed. Bank account ownership authenticated at the point of entry. This isn’t about collecting information from the vendor. It’s about confirming that the information they provided is accurate and true using a source they don’t control.
Treat every banking change request as high-risk
This is the single most important BEC prevention control available to AP teams. Every request to update a vendor’s bank account number should trigger a formal authentication workflow. Not an email acknowledgment. Not a reply to the thread. A separate, structured verification process.
Use out-of-band authentication the right way
Out-of-band authentication means verifying a request through a channel separate from the one used to make it. In practice, that means calling the vendor on a number already in your verified records, not the number provided in the update request. The number in the email may be controlled by the attacker. The number in your pre-verified vendor file predates the compromise. That distinction is the entire point.
Most AP teams know they should call to confirm. The failure is calling the wrong number — the one in the request — which is exactly what a BEC attacker expects and prepares for.
Enforce segregation of duties
No single person should be able to process a banking change request and approve the subsequent payment. This doesn’t stop every BEC attack, but it adds a second set of eyes at the moment when misdirected payments are most likely to get caught. Segregation of duties is also one of the first things auditors look for, and one of the most commonly violated controls in resource-constrained AP departments.
Automate sanctions and watchlist screening
New vendors and banking changes should be screened against OFAC, SAM.gov and other lists at the point of onboarding and on an ongoing basis. Manual screening is inconsistently applied. Automated screening isn’t.
Build a documented audit trail
For every vendor onboarded and every banking change processed, you need a record of what verification was performed, when, and what it returned. This matters for audits. It also matters if fraud does occur and your insurance company asks you to reconstruct what happened.
Learn How to Prevent Business Email Compromise with PaymentWorks
Take a Self-Guided Demo The Specific Gap Most AP Teams Miss
Understanding how to prevent business email compromise in theory is easier than actually closing the gap that BEC exploits in practice.
The most common failure pattern isn’t that organizations lack BEC prevention policies. It’s that their policies are inconsistently applied, not audited, and generally apply to new vendors but not to changes for existing ones. Established vendor relationships receive less scrutiny almost everywhere. This is a known and frequently exploited pattern. Attackers specifically target existing vendor relationships because the baseline of trust is already established, and the verification instinct is lower.
If your BEC prevention controls don’t apply equally to a banking change from a vendor you’ve paid for five years, you have a gap. And attackers know where to look.
What Recovery Looks Like —and How to Prevent Business Email Compromise in the Future
ACH reversals have a narrow window measured in days. If BEC gets through, the practical expectation in most cases is that the payment is gone.
The financial loss is the visible part. The less visible part: internal investigations are expensive and disruptive. Vendor relationships take damage when a legitimate supplier’s identity gets exploited. Audit and regulatory scrutiny intensifies after an incident. For organizations in regulated industries, the downstream compliance implications can outlast the initial loss significantly.
This is why BEC prevention belongs upstream, in the vendor onboarding and payment change workflow, before a fraudulent payment ever reaches final approval. Processes and tools that only monitor vendor data once it’s in your workflow create disruptions and introduce risk at time-sensitive payment time. Post-incident response has a role. It’s not the investment that moves the needle.
How to Prevent Business Email Compromise With PaymentWorks
PaymentWorks is a vendor identity platform that removes the email inbox as a verification channel for vendor payment data. That’s the core of what it does.
When a vendor is onboarded through PaymentWorks, their identity is authenticated against first- and third-party data sources before banking information enters your ERP. Bank account ownership is validated, not assumed. Sanctions screening runs continually. The process generates a documented audit trail at every step.
When a banking change request comes in, it routes through an authentication workflow before the change takes effect. The vendor proves ownership of the account through a structured process, not a reply to an email thread.
The result is a BEC prevention posture that doesn’t depend on your AP team catching the one convincing spoofed email that makes it through. The controls run because the workflow runs. Consistently. Every time.
PaymentWorks backs this with the best-in-market $2M indemnification for vendor impersonation fraud. That’s a contractual commitment grounded in confidence that the controls work.
Where to Start
Take a self-guided demo to see how to prevent business email compromise with PaymentWorks.
See how PaymentWorks works