Business Email Compromise Prevention: Wire Fraud Playbook for SMBs

TL;DR: Business email compromise prevention is not about buying the fanciest security toy. It is about hardening your email domain (SPF, DKIM, DMARC), locking down logins (phishing-resistant MFA), and putting a boring, repeatable verification process around vendor payments so one sketchy email cannot reroute your money.

If you are a Palm Beach County small business, BEC is expensive because it targets your real workflow. The scammer does not need to “break in” like it is a Hollywood movie. They just need one weak mailbox and one employee who is rushing.

Why business email compromise prevention matters (and why filters miss it)

I see this exact problem three times a week. Not always as “we got hacked.” More like: “We paid an invoice, and now the vendor says they never got it.” That is invoice fraud and wire fraud prevention is the only sane response.

Back in my day, scams came in the mail with bad spelling and a return address from “Totally Real Bank, Nigeria.” Now they look like your owner, your bookkeeper, or your vendor. Same con, better costume.

What BEC usually looks like in SMBs

• Executive impersonation scams: “Hey, I need this paid today. I am in a meeting.” (They love meetings. Meetings are their alibi.)
• Vendor payment reroute: “We changed banks. Please update the ACH details.”
• Invoice attachment swap: Real vendor thread, fake PDF, new routing number.
• Mailbox takeover: Attacker logs into a real mailbox, watches conversations, then strikes at the right moment.

Why traditional security tools often shrug

BEC often uses:

• Legitimate accounts (compromised mailboxes) so the email is not obviously “spam.”
• Lookalike domains (domain spoofing) like vend0r.com instead of vendor.com.
• No malware at all, just social engineering and payment pressure.

If your “security plan” is “we have an antivirus,” that is like saying you prevent car theft because you own a steering wheel. Helpful, but not enough.

Business email compromise prevention step 1: Lock down your domain (SPF, DKIM, DMARC)

Let us start with the unglamorous stuff that works. DMARC SPF DKIM setup is how you tell the world which servers are allowed to send email as your domain, and how receivers should treat impostors.

Do not skip this because it sounds “technical.” Back in my day we had to set IRQ jumpers on sound cards and we survived. You can handle a few DNS records.

SPF: Who is allowed to send as you

SPF is a DNS record that lists approved sending sources (like Microsoft 365, Google Workspace, your website mailer, your ticketing system). If you do it wrong, you break mail. If you do not do it, attackers have an easier time spoofing you.

• Inventory every service that sends email as your domain.
• Publish one SPF record (not five competing ones).
• Keep it under the DNS lookup limits (yes, there are limits, because of course there are).

DKIM: Prove the message was not altered

DKIM signs outbound mail so recipients can verify it came from your domain and was not tampered with. Turn it on for your primary mail platform and any supported third-party senders.

DMARC: Tell receivers what to do with fakes

DMARC ties SPF and DKIM together and lets you publish a policy: monitor, quarantine, or reject. Start with monitoring, then tighten up.

1. p=none with reporting to see who is sending as you.
2. Fix legitimate senders that fail alignment.
3. Move to p=quarantine.
4. Then p=reject once you are confident.

Also, read the reports. If you do not read the reports, you did not deploy DMARC. You just decorated DNS.

Domain spoofing detection: the simple human check

Even with DMARC, your staff needs one habit: hover and verify. Check the real address, not the display name. A scammer will happily name themselves “Accounts Payable” and hope nobody looks.

Wire fraud prevention step 2: Put a payment change request policy in writing

Here is what not to do: accept banking changes over email. Ever. I do not care if the email is polite, urgent, or includes a smiley face. (Yes, scammers use smiley faces now. We are living in dark times.)

The vendor payment verification rule (boring but works)

Use out-of-band verification for any of these:

• New vendor onboarding
• ACH or wire detail changes
• “Send it to a different account this time”
• Rush payments outside normal schedule

Out-of-band means: verify through a channel the attacker does not control. Examples:

• Call a known-good number from your vendor master file (not the number in the email).
• Use a vendor portal you already use (and you log into independently).
• In-person confirmation for high-dollar changes (yes, really).

Two-person approval for wires and ACH changes

Wires should not be “one person, one inbox, one click.” Require:

• Requester and approver are different people.
• Approver verifies out-of-band.
• Documented confirmation (ticket, note, call log).

This is the same idea as not letting one teenager be the only one with keys to the car and the credit card. Controls exist because humans are human.

Invoice fraud red flags your team should stop ignoring

• New bank details “effective immediately”
• Odd grammar from a normally professional vendor
• Reply-to address differs from from-address
• Payment instructions moved from portal to email PDF
• Pressure: “CEO approved, do it now”

Email security for small business step 3: Stop mailbox rules and forwarding attacks

If I had a dollar for every time an attacker created a sneaky inbox rule, I could retire and buy a warehouse of beige CRT monitors for nostalgia.

A classic move is an email forwarding attack or a mailbox rule that silently:

• Forwards all mail to an external address
• Moves bank-change emails to Archive or RSS feeds
• Deletes security alerts

Mailbox rule auditing checklist

For Microsoft 365 or Google Workspace environments, you want periodic reviews. At minimum, check:

• Inbox rules that forward, redirect, or delete
• Mailbox-level forwarding settings to external domains
• Delegated access and app passwords (if still enabled)
• OAuth app consents that look “helpful” but are not

If you find unexplained rules, assume compromise until proven otherwise. Do not “wait and see.” That is how money leaves your account.

BEC protection step 4: Use phishing-resistant MFA and conditional access

Look, I am not going to sugarcoat this: SMS codes are better than nothing, but they are not the gold standard. For BEC protection, you want phishing-resistant MFA wherever your platform supports it.

What to use (and what not to)

• Best: Passkeys (FIDO2) or hardware security keys for admins and finance users.
• Good: Authenticator app number matching and strong sign-in policies.
• Avoid when possible: SMS-only MFA for high-risk roles.

Conditional access: stop risky logins before they become your problem

Conditional access (available in many business identity setups) can block or challenge logins based on risk signals like unfamiliar locations, impossible travel, or unmanaged devices. You do not need “AI magic.” You need rules that say: finance mailboxes do not sign in from random countries at 3 a.m.

User awareness training that does not waste everyone’s time

Back in my day, the training was “don’t click that.” Still true. But modern BEC needs slightly better habits.

Teach three behaviors and repeat them forever

1. Slow down money movement. Urgency is the scam fuel.
2. Verify payment changes out-of-band. Every time.
3. Report weird emails fast. Not after the wire clears.

Keep it short, role-based, and relevant to accounting, admin staff, and executives. The “CEO” is often the easiest target because they are busy and used to being obeyed. (Yes, I said it.)

For general phishing recognition, Microsoft has a decent plain-English resource here: Microsoft Support guidance on recognizing and avoiding phishing.

Incident response for BEC: what to do in the first hour

Here is what actually happens when you ignore this: the attacker gets paid, the vendor gets mad, your bank asks questions, and everybody suddenly wants a “cybersecurity plan” yesterday.

If you suspect BEC or a mailbox takeover, do this in order:

Containment (right now, not later)

• Reset the user password and revoke active sessions.
• Disable external forwarding and remove suspicious inbox rules.
• Check for newly added MFA methods and remove anything you did not approve.
• Review sign-in logs for unusual locations and devices.

Payment damage control

• Call your bank fraud department immediately with wire details.
• Contact the receiving bank if possible (time matters).
• Preserve the emails, headers, and audit logs for investigation.

Eradication and recovery

• Scan affected endpoints and clean up any malware that helped the compromise. If you need help, start with professional virus removal and malware cleanup services.
• Audit all finance-related mailboxes for rules, forwarding, and delegates.
• Confirm SPF/DKIM/DMARC are correct and enforced.
• Rotate credentials for any apps tied to the mailbox (accounting tools, CRMs, email senders).

After-action: fix the process so this does not repeat

Update your payment change request policy, tighten MFA, and document who approves what. Also, make sure you have backups of critical business data. If you do not have a backup, you do not have data. You are just borrowing it. Start here: managed business backups for ransomware and fraud recovery.

A practical Palm Beach County SMB checklist (print this, tape it to the wall)

• Email authentication: SPF correct, DKIM enabled, DMARC deployed and moving toward enforcement.
• BEC protection: Phishing-resistant MFA for owners, admins, and finance; disable legacy auth where possible.
• Conditional access: Block risky logins and require compliant devices for sensitive roles.
• Vendor payment verification: Out-of-band confirmation for all bank detail changes, plus two-person approval.
• Mailbox rule auditing: Monthly review of forwarding, rules, delegates, and suspicious app consents.
• Incident response for BEC: Written first-hour steps, bank contact info, and log retention plan.
• Recovery plan: Tested backups and a plan for rapid restore. If the worst happens, professional data recovery services may help, but it is slower and more expensive than doing backups right.

Local note from behind the repair counter (West Palm Beach and beyond)

Fix My PC Store is based in West Palm Beach, and we work with businesses across Palm Beach County. That includes the usual suspects: West Palm Beach, Palm Beach Gardens, Lake Worth Beach, Boynton Beach, Jupiter, Wellington, Royal Palm Beach, and Boca Raton. BEC does not care what zip code you are in, but it sure loves SMBs who “mean to get to security later.”

If you want a deeper read on how BEC works and why it keeps winning, Malwarebytes lays it out clearly: Malwarebytes overview of Business Email Compromise (BEC) and prevention.

If you are serious about business email compromise prevention, the best move is a short, focused security assessment: verify your DNS authentication, review your tenant settings, test MFA, and sanity-check your payment workflow. That is what small business cybersecurity services should look like. Not a 90-page report that nobody reads.