BEC Prevention Checklist

Wire Transfer & Payment Controls

BEC causes more dollar losses than any other cybercrime category. The attack exploits process gaps, not technical vulnerabilities — controls must be procedural.

• Establish a call-back verification procedure for all wire transfersCall the requestor at a known, pre-established phone number — not a number in the email. Never use contact information from the request itself.
• Require dual authorization for any outbound wire above a defined thresholdTwo individuals must independently approve — not just review the same email thread. Define the threshold in written policy (common: $5,000–$25,000).
• Create an explicit change-of-bank-account procedureAny request to update a vendor or employee bank account requires: written request + manager approval + call-back verification to an established number. Changes are not effective until confirmed.
• Prohibit wire transfers or ACH changes initiated solely by emailEmail can be the notification, never the sole authorization. The actual approval must occur through an out-of-band channel.
• Limit same-day wire capability to named, pre-approved staffAttackers exploit urgency. Require next-day settlement for new payees unless the urgency has been verbally verified by a senior officer.
• Review and verify new-vendor ACH instructions before first paymentCall the vendor directly using a number from your records or their official website — not from the invoice. Confirm routing and account numbers verbally.
• Train accounts payable staff on common BEC scenarios annuallyCEO fraud, vendor impersonation, invoice manipulation, and real estate wire fraud are the four most common patterns. Tabletop the scenarios, not just slides.

Email Authentication — SPF, DKIM, DMARC

SPF and DKIM establish identity; DMARC enforces policy on mismatches. A domain without DMARC enforcement (p=none) is spoofable by anyone.

• Publish an SPF record listing every server authorized to send as your domainInclude all email sending sources: mail servers, ESPs, marketing tools, HR systems. Use ~all (softfail) initially, then -all (hardfail) once the full sending inventory is confirmed.
• Enable DKIM signing in your email platform for your primary domainDKIM key length: minimum 2048 bits. Rotate DKIM keys annually. Verify signature via a header analyzer after enabling.
• Publish a DMARC record and advance to enforcement (p=reject) over timeStart with p=none to collect reports, then p=quarantine, then p=reject. Use DMARC aggregate reports (rua=) to find legitimate sources before tightening policy.
• Enable DMARC reporting and review aggregate reports monthlyAggregate reports (rua) show all sources sending as your domain. Forensic reports (ruf) include sample failing messages. Both are needed to catch unauthorized use.
• Cover all subdomains in DMARC policySet sp=reject in your DMARC record to apply enforcement to subdomains you don't use for email. Unprotected subdomains are common BEC spoofing targets.
• Monitor for lookalike domain registrationsAttackers register domains like company-invoices.com or c0mpany.com. Use a domain monitoring service or periodic manual searches for common substitutions on your key domains.

Social Engineering Red Flags

BEC relies on bypassing process controls by manufacturing urgency, authority, or trust. Train staff to recognize these patterns — and to treat them as reasons to slow down, not speed up.