BEC Red Flags: How to Identify and Stop Business Email Compromise Before Financial Loss Hits Your Organization

Every day, finance and HR teams receive emails that look routine but carry a hidden instruction to move money or hand over data. One misjudged click separates a normal Tuesday from a six-figure loss that no bank can reverse. The gap between a thwarted cyberattack and an unrecoverable wire transfer often comes down to whether one person recognized the warning signs in time.

BEC red flags are the behavioral, linguistic, technical, and contextual signals that separate a fraudulent business email compromise attempt from legitimate correspondence. This guide covers:

• Sender impersonation BEC red flags, including look-alike domains, reply-to mismatches, and personal-account spoofing.
• Executive authority exploitation and the social engineering scripts that pressure compliance.
• Urgency language, payment-redirection BEC red flags, and the AI-generated messages that erase classic detection cues.
• Technical email security anomalies hidden in headers, plus role-specific targeting and real-world case studies.

Recognizing BEC red flags on a slide is one thing; catching them under pressure is another. Adaptive Security tests employees against these exact signals through realistic, multi-channel phishing simulations.

Explore the phishing simulations platform

Sender Impersonation Red Flags: Spotting the Fake Before it Reaches You

Business email compromise depends on one thing: the moment a recipient believes the sender is who they claim to be. Sender impersonation is the first and most common of the BEC red flags, and it survives most inboxes because the human brain reads a familiar name as a trust signal before it processes anything else. According to the FBI Internet Crime Complaint Center's Public Service Announcement I-091124-PSA (2024), BEC generated more than $55 billion in global exposed losses across over 305,000 incidents between October 2013 and December 2023, and every one began with impersonation that survived a glance.

A properly authenticated corporate email routes through verified domain infrastructure with aligned SPF, DKIM, and DMARC records. Yet enforcement remains rare.

Cyberattackers exploit that gap by manipulating what the recipient sees: the display name, the domain spelling, the reply-to path. Each technique targets the same weakness, so the defense has to address perception rather than only infrastructure.

Domain authentication protects the perimeter, but most impersonation walks through gaps that SPF and DKIM never cover. Adaptive Security trains employees to catch the look-alike sender before the reply leaves the building.

Take a self-guided tour

What Makes Look-Alike Domains, Typo-Squatting, and Display Name Spoofing so Effective?

Look-alike domain registration is the most mechanically simple impersonation tactic available to BEC cyberattackers. The cyberattacker purchases a domain that differs from the real one by a single character, rnicrosoft.com instead of microsoft.com, then configures it to send mail that passes a rapid visual scan. These domains are frequently registered hours before a cyberattack launches, specifically to avoid threat intelligence feeds that rely on domain age as a reputation signal.

Typo-squatting amplifies this technique by targeting the habits recipients fall into when composing email quickly. Domains like gmall.com or paypaI.com, with a capital "I" replacing the lowercase "l", catch recipients who skim the sender field on mobile devices where the full address is truncated. On a smartphone screen, a one-character difference stays functionally invisible until someone expands the sender header, an action most employees never take during a busy workday.

Display name spoofing operates on a different layer entirely and requires no domain registration at all. The cyberattacker configures any email account, often a free webmail address, to display a forged sender name that matches a real executive.

Most email clients prioritize the display name over the actual address in the default inbox view, so the name fills the preview pane while the address hides behind a tap. The scheme depends entirely on the recipient never taking that extra step.

Why do Reply-To Mismatches and Personal Account Impersonation Bypass Security?

A reply-to mismatch exploits email client behavior rather than human perception. The visible From: address appears completely legitimate, jane.smith@company.com, but the Reply-To: header routes responses to a cyberattacker-controlled address. The cyberattacker does not need to compromise the real domain, only an SMTP server that does not enforce alignment between the From and Reply-To fields.

The finance team member who responds to an urgent vendor payment request may never notice their reply is leaving the organization entirely. Personal account impersonation is cruder but equally effective, arriving from ceo.name123@yahoo.com with a message claiming the executive is traveling, locked out, or handling an emergency. The display name matches, the tone is urgent, and any employee who has processed similar legitimate requests during business travel may comply without a second thought.

The red flag in both cases is identical: the sender's actual address does not originate from the organization's domain. Organizations that codify out-of-band verification into their financial approval workflows, such as a phone call, a Slack message, or a conversation through a channel the cyberattacker does not control, eliminate the one weakness both techniques rely on.

How Does Attacker Reconnaissance Enable Convincing Impersonation?

None of the techniques above would succeed at scale without the reconnaissance that makes impersonation feel authentic. Cyberattackers mine names, titles, reporting relationships, and travel schedules from sources the organization itself makes public. LinkedIn provides the organizational chart, company websites add office locations and direct phone numbers, and SEC filings disclose vendor contracts and subsidiary relationships.

Social media posts fill in the rest, revealing internal project names, conference attendance, and the casual language employees use with each other. Dr. Suleman Lazarus, Visiting Fellow at the Mannheim Centre for Criminology at the London School of Economics, has published research on BEC cybercriminal networks drawn from rare direct interviews with syndicate members. His work describes cyberattackers who methodically map an organization before making contact, so that a single email can reference a real project, a recent conference, and a payment the finance team already expects.

The defense against reconnaissance-enabled impersonation is not to withdraw from public platforms. It is to accept that this information is available and to enforce verification protocols that make the quality of the impersonation irrelevant. When every financial request requires confirmation through a second channel regardless of how authentic it appears, the cyberattacker's research investment produces no return.

Public data gives cyberattackers everything they need to impersonate a trusted colleague convincingly. Adaptive Security conditions the verification reflex that renders that reconnaissance worthless.

Book a demo

Authority and Executive Impersonation Red Flags: When the 'CEO' is Really a Criminal

Executive impersonation succeeds because organizational hierarchies train employees to comply with authority figures without hesitation. Cyberattackers exploit this conditioned deference by fabricating urgency and demanding secrecy, and these BEC red flags rarely rely on technical sophistication. They weaponize trust, timing, and the universal reluctance to say no to a superior, which is why CEO fraud remains the most financially devastating BEC subtype.

Every executive impersonation cyberattack follows a psychological script. An employee in finance, HR, or executive support receives a message that looks like a direct request from the CEO, CFO, or another senior leader.

The message is terse, urgent, and personal, and it asks for something the organization routinely does: wire a payment, change banking details, or share sensitive payroll information. Because the request mirrors legitimate business activity and carries the weight of executive authority, it bypasses the scrutiny that would normally flag a suspicious external email.

According to the FBI's Internet Crime Report 2025, released April 2026, business email compromise accounted for $3.046 billion in reported losses across 24,768 complaints, averaging roughly $123,000 per case and ranking second only to investment fraud. That scale is built one impersonated executive at a time.

CEO Fraud: The Mechanics and Telltale Language

CEO fraud begins with reconnaissance. Cyberattackers harvest organizational charts, executive bios, travel schedules, and reporting structures from LinkedIn, company websites, earnings call transcripts, and other open-source intelligence (OSINT). They learn who reports to whom and which employees hold the keys to financial transfers, then craft a message that lands with precision, often using a look-alike domain, a compromised executive account, or a webmail address spoofing the executive's name.

The language of CEO fraud is deliberately recognizable. Standard red-flag phrases include "I'm unavailable by phone," "I'm in a meeting all day," "Handle this confidentially," and "This needs to go out before the close of business." Each phrase serves a function: claiming unavailability preempts the instinct to verify, demanding confidentiality isolates the employee from colleagues who might question the anomaly, and imposing a tight deadline short-circuits deliberation.

The most dangerous CEO fraud emails do not ask for anything obviously criminal. They request a routine wire transfer for an acquisition "the board is finalizing today," or a gift card purchase for an employee recognition initiative. The amounts are plausible and the context fits the executive's known priorities. The only abnormality is the process: an approval shortcut, a deviation from the second-signer rule, or routing through an unfamiliar bank account, each justified by supposed urgency.

Research on authority bias in social engineering, including work from Carnegie Mellon University's CyLab on decision making under pressure, has found that people can override their own judgment before they consciously register they have done so, particularly when a request appears to come from a superior under severe time pressure. That cognitive shortcut is exactly what CEO fraud is engineered to trigger.

Attorney Impersonation and Payroll Diversion Scenarios

Attorney impersonation cyberattacks layer professional privilege onto executive authority. The cyberattacker poses as external legal counsel and contacts the finance team about an urgent, confidential invoice that must be paid immediately, often referencing a real pending matter identified through OSINT. Framing the payment as a matter of attorney-client privilege makes asking questions feel like a violation of professional ethics.

These cyberattacks work because legal invoices are inherently opaque to non-lawyers. A finance employee sees a plausible matter reference, a legitimate-sounding firm name, and an instruction to pay discreetly, which creates a double bind: questioning the request risks embarrassment if the invoice is real, while complying risks organizational loss. The scheme relies on the first fear overpowering the second.

Payroll diversion follows a parallel playbook but targets HR and payroll departments. The cyberattacker impersonates an employee, often a senior executive, and requests an urgent change to direct deposit information, claiming a compromised account or a switch of banks. The request arrives mid-cycle, just before payroll runs, leaving minimal time for verification, and once the deposit details change, the next cycle routes the salary to the cyberattacker.

According to the FBI Internet Crime Complaint Center's Public Service Announcement I-091124-PSA (2024), payroll diversion is a growing vector within the BEC category, exploiting the narrow window between the request and the processing deadline. Both variants exploit routine business processes rather than technical vulnerabilities, which is why email filters alone cannot stop them. They require employees who recognize when a routine request contains non-routine BEC red flags.

Why "Confidential" and "Bypass Normal Procedures" Should Always Trigger Verification

The words "confidential" and "bypass normal procedures" are among the strongest BEC red flags an employee can encounter, because legitimate executive requests almost never need either. Real confidential matters still follow payment protocols, and real urgent payments still route through the second-signer rule. When an email instructs an employee to skip the very controls designed to catch fraud, the instruction itself is the evidence of the cyberattack.

Organizations that reduce their exposure to CEO fraud share one practice: they require verification every time, with no exceptions carved out for seemingly routine requests. They also strip away the social cost of questioning authority, telling employees explicitly that no executive will ever penalize them for confirming a payment request through a second channel, even when it turns out to be legitimate. This permission structure neutralizes the psychological advantage cyberattackers depend on.

The verification protocol should be simple and non-negotiable. For any payment request or banking change that arrives via email and carries urgency, the employee confirms through a known phone number, an internal messaging platform, or a face-to-face conversation, and never by replying to the same thread. Finance and HR teams should rehearse this through phishing simulations that include executive impersonation, attorney impersonation, and payroll diversion variants.

Generative AI is already producing longer, more grammatically polished BEC emails that lack the typos once used as detection cues. But the cyberattack's fundamental weakness remains unchanged, because it still requires the victim to act without confirming, and a single verification call placed to a known number collapses the entire scheme.

One skipped verification call is the difference between a routine payment and an unrecoverable wire transfer. Adaptive Security makes that call a trained reflex through repeated executive-impersonation phishing simulations.

Book a demo

Urgency and Psychological Manipulation Red Flags: The Language That Pressures Compliance

Manufactured urgency in a business email compromise cyberattack does not merely persuade; it neurologically disarms the recipient. When an employee reads "ASAP," "before EOD," or "this cannot wait," the brain's threat-detection circuitry activates and the prefrontal cortex responsible for deliberate reasoning is functionally bypassed. These urgency-driven BEC red flags succeed because they attack cognition before analysis can begin.

This shift is documented in a 2024 neurobiological model showing that acute stress drives decision-making toward rapid, reflexive responses at the expense of cognitive flexibility. In the seconds after a pressure-laden email lands, the cyberattacker bets everything on the recipient skipping the one verification step that would break the scheme.

The behavioral science says that bet wins far more often than it should. According to Verizon's 2026 Data Breach Investigations Report, the human element was involved in 62% of breaches, which underscores why urgency-based manipulation remains such a productive tactic.

Urgency Language Patterns and why They Work

The most common BEC urgency signals follow a predictable linguistic template. "Need this processed before EOD," "I'm about to board a flight, handle this now," "Immediate action required," and "While I'm in transit" share the same structural DNA: they compress the decision window to the point where verification feels like insubordination. The phrase "this can't wait" does something subtler, implying the recipient already understands the context and making clarifying questions feel professionally embarrassing.

These patterns exploit what cognitive psychologists call the speed-accuracy trade-off. A 2025 study on time-pressured decision-making found that novices under time constraints showed a marked decline in decision accuracy and visual search efficiency, while experts maintained performance by relying on trained cognitive schemas. The cyberattacker's insight is that most employees are novices at detecting phishing, so they lack the mental frameworks that would let them process urgency cues without being destabilized.

The mechanism is physiological. Perceived urgency triggers the sympathetic nervous system, elevating cortisol and narrowing attentional focus to the immediate demand, which starves the exact cognitive function that would flag an unusual wire request or an uncharacteristic tone shift. By the time rational processing recovers, the transfer is complete.

Beyond Urgency: Reward, Consequence, and Authority Appeals

BEC cyberattackers do not rely on urgency alone. The psychological playbook extends to at least four additional levers, each calibrated to bypass a different cognitive defense:

• Promised rewards appear in phrasing like "bonus pending, confirm details to process" or "approval triggers the commission payment." The reward lever exploits the brain's dopamine response to anticipated gain, a mechanism documented in behavioral economics research on risk perception under reward anticipation, which reduces scrutiny.
• Implied consequences weaponize fear of professional repercussions, using language such as "this will reflect poorly on the performance review." Compliance is reframed as career-preserving behavior, a lever especially effective in hierarchical cultures where questioning authority carries real risk.
• Appeals to authority exploit deference toward senior leadership, invoking "the CEO personally asked for this" or "per the CFO's instructions" as a substitute for verification. When a request appears to come from someone with the power to hire and fire, the perceived cost of non-compliance feels higher than the risk of complying.
• Manufactured scarcity triggers loss aversion through phrasing like "vendor pricing expires at midnight." People feel losses more intensely than equivalent gains, and cyberattackers exploit that asymmetry with precision.

Tone Shifts as a Behavioral Red Flag

One of the most overlooked BEC red flags is a departure from established communication norms. Cyberattackers cannot replicate the nuanced relational history between a real executive and their team, and that gap produces detectable anomalies worth training employees to notice.

An email from a normally casual executive that suddenly uses formal language, stiff syntax, or unusually structured requests warrants immediate suspicion, and the reverse is equally telling. These tone shifts occur because the cyberattacker works from a generic template of professional communication rather than the specific relational style the recipient knows. The cyberattacker is impersonating a role rather than a person, and that gap shows up in word choice, sentence length, and emotional register.

Other behavioral signals include out-of-context requests, such as an HR director suddenly demanding wire transfer details, and communication through unusual channels. An executive who has exclusively used Slack for months suddenly sending urgent demands via personal email represents a deviation that should trigger verification. Phishing simulations that expose employees to realistic urgency language, authority appeals, and tone-shift scenarios build the cognitive schemas that enable expert-level resistance.

Under manufactured pressure, knowledge of the warning signs evaporates and habit takes over. Adaptive Security rehearses employees through the exact urgency and authority scenarios that break untrained cognition.

Take a self-guided tour

Financial and Payment Redirection Red Flags: When the Money Trail Suddenly Changes

When a finance team acts on a payment-redirection BEC email without verification, funds transfer directly into cyberattacker-controlled accounts, and once the wire clears, the reversal window closes within hours. Payment redirection is the highest-stakes category of BEC red flags, because a single misrouted transfer can drain six or seven figures in an afternoon where credential phishing accrues damage gradually.

According to the FBI IC3's 2024 Annual Report, fraudulent BEC transfers have been routed through banks in 186 countries, drawing on analysis of over 305,000 incidents and making fund recovery extraordinarily difficult. Finance departments remain the primary target.

According to the AFP 2026 Payments Fraud and Control Survey, released April 2026, about 74% of organizations experienced BEC activity in 2025, an increase from the prior edition. Understanding the specific warning signs is the difference between catching fraud before settlement and explaining an unrecoverable loss to the board.

The Payment-Change Request: Anatomy of the Most Common BEC Scenario

The classic payment-redirection cyberattack follows a predictable script. A finance team member receives an email, often on a Thursday or Friday afternoon, from a source that looks like a known vendor, supplier, or business partner. The message is brief and reasonable: "We've updated our banking details. Please remit the outstanding invoice to this new account," with a tone, logo, and signature block identical to legitimate correspondence.

The red flag is structural rather than cosmetic. Any unsolicited change to established payment instructions is inherently suspicious, because vendors do not casually switch banking relationships mid-cycle.

A Hong Kong account for a domestic supplier or a UAE-based bank for a European partner should trigger an automatic halt. FBI IC3 case data confirms that the United Kingdom, Hong Kong, China, Mexico, and the UAE are the most common intermediary destinations for BEC proceeds.

Cyberattackers exploit timing with precision. Requests arrive late in the day, before holidays, or during the end-of-quarter crush when finance teams process high volumes of legitimate payments under deadline pressure. The goal is to wedge the fraudulent request into a stack of real ones, betting that fatigue and urgency will override verification instincts.

Fake Invoice Fraud and Vendor Impersonation

Fake invoice fraud takes payment redirection a layer deeper. Instead of sending a change-of-details email, cyberattackers generate invoices that replicate a real supplier's billing documents down to the purchase order numbers, line-item descriptions, and payment terms, changing only the banking coordinates at the bottom.

These counterfeit invoices often arrive through compromised vendor email accounts, which makes them nearly impossible to flag through sender reputation alone. When a real vendor's actual address sends a fake invoice, standard authentication protocols like SPF and DKIM pass, so the email is authentic while the content is fraudulent. This is what makes vendor impersonation the most dangerous subset of BEC, because the trust signal of a known contact overrides every automated defense.

Finance teams should treat any invoice that arrives outside the normal billing cycle, contains unfamiliar payment instructions, or references an unfamiliar bank as a high-priority verification item. The dollar amounts are typically calibrated to sit just below the level that would require a second signatory, because cyberattackers research approval limits in advance.

Verification Protocols Every Finance Team Needs

Verification is the only reliable defense against payment redirection, and it must be mandatory rather than discretionary. The core rule is that every payment-change request, regardless of how routine it appears or who it seems to come from, must be confirmed through a separate, out-of-band channel before any funds move.

The protocol should require a live phone call to a number already on file rather than one listed in the email requesting the change, and a video call adds a second layer of identity confirmation for high-value transfers. Email replies are not verification, because a compromised account will simply confirm the cyberattacker's own request. Finance teams should also maintain a whitelist of approved vendor banking details and flag any deviation for manual review, no exceptions.

End-of-quarter and fiscal-year-close periods demand heightened scrutiny, so when payment volume spikes, teams should slow down rather than speed up. Organizations that incorporate these patterns into multi-channel phishing simulations, with role-specific scenarios that test whether finance employees actually pick up the phone before wiring funds, make verification automatic rather than optional. A protocol that exists only in a policy document will not survive a 4:45 p.m. Friday request with "URGENT" in the subject line.

A whitelist and a phone-verification rule mean nothing if no one uses them under deadline pressure. Adaptive Security stress-tests finance teams against realistic payment-change fraud until verification becomes instinct.

Book a demo

Linguistic, Stylistic, and Tone Red Flags: Reading Between the Lines

Classic BEC emails broadcast their illegitimacy through surface-level language errors, while AI-generated BEC emails hide it behind grammatically flawless, professionally toned prose. Both variants succeed or fail on the same variable, which is whether the recipient stops long enough to ask if the request itself makes sense. AI has raised the stakes by removing the easiest detection shortcut, so these linguistic BEC red flags now demand a sharper eye.

Classic Linguistic Red Flags: Grammar, Spelling, and Generic Greetings

The most reliable BEC detection cues have historically been the simplest ones. Misspellings, subject-verb disagreement, missing articles, and the stilted syntax of a non-native English speaker operating under time pressure all signal fraud within seconds. Generic greetings like "Dear Sir/Madam," "Hello Dear," or the infamous "Kindly" are dead giveaways, because no internal colleague addresses a coworker this way and no legitimate vendor opens a payment request without a specific name.

These errors persist despite years of awareness because many BEC groups operate from regions where English is not a first language, and high-volume campaigns prioritize speed over polish.

Beyond surface errors, classic BEC emails frequently exhibit odd tonal shifts, such as excessively formal language in what should be a casual internal exchange. An email that opens with "I hope this message finds you in good health" and then demands a wire transfer combines two incompatible registers. Employees who read emails aloud before acting catch these mismatches faster, because the ear often detects what the eye skims past.

The AI-Generated BEC Email Problem

Generative AI has rewritten the economics of BEC, because cyberattackers no longer need fluency to produce fluent emails. Large language models generate grammatically perfect, idiomatically natural prose in seconds at zero marginal cost per target.

AI-generated BEC emails eliminate the grammatical and spelling errors employees have been trained to spot for two decades. They use contractions naturally, deploy industry terminology correctly, and mimic the casual warmth of internal communication, and an AI-written request can include the exact sign-off a real executive uses and reference a real project scraped from LinkedIn.

This fluency creates a dangerous asymmetry, because the employee's mental checklist of classic red flags returns no matches and the absence of obvious errors creates an illusion of legitimacy. Training that relies solely on spotting bad grammar is obsolete against this cyber threat vector.

Detection Cues That Survive AI Polish

Even when AI scrubs an email of grammatical errors, the message cannot fabricate what the cyberattacker does not know, so contextual inconsistencies remain the most durable detection signal. An AI-generated email might reference a project that exists but request action through a process that does not, such as asking finance to wire funds for a deal that closes through a different workflow. These factual errors about internal operations survive any amount of AI polish.

Subtle deviations from corporate writing conventions also persist. Every organization develops unwritten norms, whether people use first names in greetings or sign off with "Best" or "Thanks," and AI defaults to statistically generic text that lacks the idiosyncrasies a real colleague accumulates over years. AI cannot replicate what it has never observed firsthand.

AI-generated text also tends toward verbosity, while real executives under pressure typically write shorter emails rather than longer ones. When an urgent request arrives in perfectly structured paragraphs that no busy person would compose, the fluency itself is the red flag, so detection means shifting employee focus from how an email sounds to what it asks for, a skill that requires realistic practice through multi-channel phishing simulations that include BEC scenarios.

Grammar-based detection collapses the moment a cyberattacker opens a language model. Adaptive Security retrains employees to interrogate the request itself rather than the polish of the prose.

Explore the platform

Timing and Contextual Red Flags: When an Email Arrives Matters as Much as What it Says

Cyberattackers exploit the calendar with the same precision they use to forge sender addresses, so the timing and contextual BEC red flags surrounding a message are often more revealing than its content. BEC emails are deliberately timed to arrive when staffing is thinnest, decision-makers are unreachable, and pressure to act quickly overrides verification instincts.

After-Hours, End-of-Day, and Pre-Weekend BEC Timing

The Friday afternoon wire transfer is the archetypal BEC cyberattack for a reason. An email from the CEO lands at 4:47 p.m. requesting an urgent payment to close a deal before the weekend, the CFO is already offline, and the bank's wire cutoff is in 13 minutes. Every element is weaponized: the sender's authority, the compressed deadline, and the absence of anyone who could verify in person.

Cyberattackers favor these windows because bank fraud recovery moves slower than their own operations. Once a wire clears across international borders, recovery depends on immediate action by both financial institutions. According to the FBI's Internet Crime Report 2025, BEC drove $3.046 billion in reported losses, and a substantial share of those transfers were initiated during end-of-day or pre-weekend windows when internal approval chains collapse to a single person with transaction authority.

An email that arrives at 8:00 a.m. on a Tuesday invites scrutiny, while the same email at 5:15 p.m. on a Friday exploits a structural gap in how organizations process urgent financial requests. The clock does more work for the cyberattacker than the wording ever could.

End-of-Month and Fiscal-Period Targeting

Finance teams under end-of-month and end-of-quarter pressure operate differently. The imperative to close books, reconcile accounts, and process outstanding payments creates a tempo that cyberattackers understand, and an invoice that appears routine during a normal week becomes a priority to clear when it threatens month-end reporting. BEC operators craft requests to align with these compressed windows, knowing verification steps get shortened when the alternative is a missed deadline.

Holiday and Vacation Exploitation Patterns

BEC campaigns follow the holiday calendar with near-predictable rhythm. Gift card scams spike before year-end, invoice fraud intensifies ahead of major regional holidays, and any period when senior executives are predictably out of office becomes an attack surface. A request attributed to a CFO on vacation cannot be verified by walking down the hall, and a payment flagged as critical before a holiday shutdown carries natural urgency.

In a November 2024 warning, the FBI and CISA identified holiday periods as heightened-risk windows for BEC fraud, noting that security and finance teams operate with skeleton staffing when threat activity accelerates. When the person who normally authorizes wire transfers above $50,000 is unreachable, the backup approver, often less familiar with the vendor, becomes the target.

A BEC email that arrives the Wednesday before Thanksgiving, requesting payment to prevent a supply-chain disruption, lands in an environment where both the primary approver and the institutional memory about that vendor may be absent until the following Monday. By then, the funds are unrecoverable, which is why the calendar functions as the cyberattacker's force multiplier.

Cyberattackers time their strikes for the exact hours when verification chains collapse to a single person. Adaptive Security prepares backup approvers for the Friday-afternoon and holiday scenarios cyberattackers exploit most.

Take a self-guided tour

Technical Email Header and Authentication Red Flags: What the Metadata Reveals

Email headers are the forensic layer most security teams ignore, yet they contain every authentication handshake, every relay hop, and every mismatch between what an email claims to be and what it is. For technical BEC red flags, inspecting headers for SPF, DKIM, and DMARC failures, anomalous relay paths, and missing external sender banners is the fastest way to distinguish a legitimate message from a spoofed one. The workflow is to verify authentication results, trace the server route for anomalies, check for missing external-sender warnings, and unwind any embedded redirect chain before trusting the message.

1. SPF, DKIM, and DMARC Inspection for Domain Spoofing

A BEC cyberattacker's primary technical goal is making a fraudulent email appear to originate from a domain the organization trusts: the CEO's, a law firm the organization works with, or a vendor awaiting payment. Email authentication protocols exist to prevent exactly this, and the headers reveal whether they worked.

Open the raw headers of any suspicious email and locate the Authentication-Results field, inserted by the receiving mail server, which reports the outcome of each protocol check. A pass on all three confirms the email came from an authorized source, while a failure on any one, particularly DMARC, is a red flag that demands immediate inspection.

SPF (Sender Policy Framework) validates whether the sending server's IP address is authorized by the domain in the Return-Path. An SPF failure means the email was sent from an unauthorized IP, and cyberattackers exploit the fact that SPF checks the envelope sender, invisible to the recipient, rather than the From header the user sees. A spoofed domain can pass SPF while a forged From address sits right next to it.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature validated against a public key in the sender's DNS, and a DKIM failure indicates the email was altered in transit or signed with an unauthorized key.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together with a policy telling receiving servers what to do when authentication fails.

When inspecting headers, look for dmarc=fail in the Authentication-Results. If the policy reads p=none, the receiving server logged the failure but delivered the email anyway, and if the domain is the organization's own and an internal-looking message still shows p=none, that is an active vulnerability rather than a configuration detail. Organizations that train employees to inspect these headers during phishing simulations build the muscle memory to spot authentication failures before trusting an email.

2. Server Route Anomalies and the Missing External Sender Banner

Every email header contains a Received chain: a chronological stack of every mail server that handled the message, read bottom to top. The first Received line is the originating server, and for BEC detection, the value lies in what should not be there.

Compare the purported sender domain against the originating IP address and hostname in the first Received line. An email claiming to come from @your-company.com that originates from an IP in a foreign country with no office, or from a residential ISP or commodity VPS, is a definitive red flag. A mail path that passes through sendgrid.net when the company uses Microsoft 365, or originates from an AWS EC2 IP when mail infrastructure runs on-premises, reveals the sender is not who they claim.

Reverse DNS lookups add another verification layer. A legitimate corporate email server will have a PTR record, the reverse DNS entry that maps an IP address back to a hostname, matching its hostname and domain. An IP with no PTR record, or one resolving to a generic cloud hostname like ec2-54-123-45-67.compute-1.amazonaws.com, is inconsistent with a legitimate business sender.

The missing external sender banner is a subtler but equally critical signal, because most organizations prepend a warning such as "[EXTERNAL]" to inbound messages from outside the domain. When an email that purports to come from an external party lands without that banner, one of two things has happened. Either a compromised internal account is being used for the cyberattack, or a mail-gateway misconfiguration let an external message bypass the banner rule, and both scenarios demand a banner audit.

3. Redirect Chains and URL Shortener Abuse in BEC

BEC emails often include a link: an invoice to review, a document to sign, a payment portal to access. The link is the payload, and cyberattackers invest heavily in making it look harmless, most commonly by embedding URL shorteners and multi-hop redirect chains that hide the true destination from both the recipient and email security filters.

Email security gateways assign reputation scores to domains visible in the message body, so a link to bit.ly or tinyurl.com inherits the sterling reputation of services used by millions of legitimate businesses daily. According to the APWG Phishing Activity Trends Report Q4 2025, cyberattackers redirected phishing campaigns through URL shorteners including TinyURL, and the SANS Internet Storm Center found that redirect-based phishing accounted for over 21% of analyzed phishing messages in the first quarter of 2026.

Modern BEC campaigns chain multiple shorteners and open redirects into sequences of three to seven hops. A link might start at t.ly, redirect to a compromised SharePoint page, bounce through a bit.ly link, and land on a credential-harvesting page, with each intermediate domain trusted individually. Only by following the entire chain does the final malicious destination reveal itself.

Cyberattackers also exploit post-creation destination modification. A link is created pointing to a legitimate Google Doc, passes every security scan, and lands in the inbox, and hours later the cyberattacker changes the destination to a phishing page. This is why a shortened URL that was safe at delivery may not be safe at the time of click.

For any suspicious BEC email containing a link, unwinding the redirect chain is non-negotiable. Use a redirect checker to follow every HTTP hop to the final destination, and treat warning signs such as more than two redirects, a recently registered destination domain, an HTTPS-to-HTTP downgrade, or multiple different shortener services in one chain as indicators of deliberate obfuscation. The destination should then be checked against threat intelligence databases before anyone clicks.

Header metadata exposes the spoofed sender and the buried redirect chain that fool the human eye. Adaptive Security teaches teams to read the forensic layer where BEC hides.

Explore the platform

Role-Specific BEC Targeting: Who Attackers Target and Why

BEC cyberattackers select targets on one criterion: proximity to money movement or sensitive data. Understanding role-specific BEC red flags means recognizing that nearly every case traces back to a carefully chosen individual whose job function gave the cyberattacker the access they needed. According to the FBI's Internet Crime Report 2025, BEC produced $3.046 billion in losses across 24,768 complaints, and each of those complaints started with a person rather than a system.

Finance staff, HR personnel, executive assistants, and brand-new employees each present distinct vulnerabilities. Cyberattackers use OSINT gathered from LinkedIn, company websites, press releases, and social media to map organizational structures before striking, which is why the defense has to be calibrated to the roles cyberattackers target most.

Finance, HR, and Payroll: The Primary BEC Targets

Finance and accounting teams sit at the center of every BEC attack vector because they control the wire transfers, invoice approvals, and vendor payment workflows that convert a fraudulent email into cash.

HR departments hold W-2 forms, Social Security numbers, direct deposit records, and the personally identifiable information (PII) of every employee. A single compromised HR inbox can yield enough data to file fraudulent tax returns for an entire workforce, and cyberattackers often pose as the CEO requesting an updated payroll report, exploiting HR's institutional deference to leadership requests.

Executives themselves are rarely the direct victims; instead, their identities are the weapon. The CEO, CFO, or managing partner's name, writing style, and communication patterns are impersonated to command compliance from subordinates who hesitate to question an urgent directive. Authority bias makes these impersonations effective even when the request deviates from standard procedure.

Why New and Entry-Level Employees are Disproportionately Vulnerable

New hires face a combination of BEC vulnerability factors, because they have not yet internalized the organization's verification norms, do not recognize colleagues' communication styles, and are often eager to demonstrate responsiveness.

Cyberattackers time these strikes deliberately. New employee announcements on LinkedIn, company blog posts, and team-page updates signal exactly who joined, when, and in what function, so a cyberattacker impersonating the CFO can send a first-week employee an urgent vendor-payment request with near-certainty that the recipient lacks the context to recognize it as abnormal.

Entry-level staff also tend to receive less security training early on. Many organizations delay phishing simulations and awareness modules until after onboarding, creating a gap cyberattackers actively exploit.

Executive Assistants: The Overlooked High-Value Target

Executive assistants may be the most under-appreciated target in the BEC attack chain. They control executive calendars, manage sensitive correspondence, draft communications on behalf of the C-suite, and often hold delegated authority to approve expenditures or schedule wire transfers. A cyberattacker who compromises an EA's account does not need to impersonate the CEO, because they already have access to the CEO's communication channel, complete with established trust relationships.

EAs are trained to be gatekeepers, which makes them structurally vulnerable to urgent directives that arrive through a channel that looks legitimate. A fraudulent email asking the EA to send the board packet or approve an attached invoice before the EOD deadline lands in the exact workflow the EA is conditioned to execute without friction.

Cyberattackers identify EAs through LinkedIn connections and scrape executive travel schedules from press releases to time their requests when the real executive is unreachable. Across every role, the common thread is the same: BEC cyberattackers weaponize organizational structure against itself, so every employee who touches money, data, or executive communications needs verification reflexes calibrated to that risk.

Cyberattackers map the org chart to find the one role with access and no context. Adaptive Security delivers role-specific training for finance, HR, and executive assistants where BEC concentrates.

Book a demo

Real-World BEC Case Studies: Red Flags Missed, Lessons Learned

The gap between recognizing BEC red flags in theory and spotting them during an active cyberattack is where organizations lose millions. The following case studies show how specific warning signs, including urgent secrecy demands, out-of-channel payment change requests, domain discrepancies, and bypassed verification, were present and overlooked with real financial consequences. Each illustrates a control that would have stopped the loss if it had been mandatory.

Case Study: The $25.6 Million Deepfake-Enabled BEC at Arup

In January 2024, Arup, the London-based multinational engineering firm, lost $25.6 million across 15 wire transfers executed in a single day. Cyberattackers used deepfake video and audio to impersonate the company's CFO and colleagues during a video conference call, and Hong Kong police detailed the incident in February 2024, with Arup confirming itself as the victim that May.

The red flags were present from the first contact. The cyberattacker sent a spear-phishing email impersonating Arup's UK-based CFO and demanding a "secret transaction" be processed urgently. The finance employee who received it initially suspected phishing, and that instinct was the most important red flag: an unsolicited, confidential request for a large transfer from an executive who does not normally initiate individual payments.

The second red flag was the secrecy demand itself, because any instruction to keep a multimillion-dollar transaction confidential is designed to prevent the recipient from consulting colleagues who might recognize the anomaly. The employee's hesitation should have triggered a mandatory out-of-band verification call to the CFO at a known number, but the cyberattackers neutralized that instinct by escalating to a video call.

The third red flag was the multi-channel escalation pattern. After the email raised suspicion, the cyberattackers scheduled a multi-person video conference where every participant was a deepfake, and seeing colleagues who looked and sounded authentic overrode the employee's initial skepticism.

The technology was convincing, but the cyberattack succeeded because the employee accepted the video call as verification when it was the cyberattack itself. According to Sumsub's Identity Fraud Report 2024, deepfake fraud incidents grew four times year over year, making this escalation pattern increasingly common. A single verification call to the actual CFO at a number already on file would have stopped the loss before a dollar moved.

Case Study: Large-Scale Vendor Impersonation and Payment Redirection

In February 2024, the Town of Arlington, Massachusetts, discovered it had been defrauded of $445,945 through a vendor impersonation BEC cyberattack targeting payments for its high school construction project. Town Manager Jim Feeney confirmed the incident in a public statement in June 2024, describing how cyberattackers compromised employee email accounts, monitored correspondence, and used a look-alike domain to impersonate a legitimate vendor.

The first red flag was the payment method change request. The real vendor had been receiving payments by check when the cyberattackers, posing as the vendor, requested a switch to electronic funds transfer with new bank account details. Any unsolicited request to change payment destination or method is a textbook red flag, particularly when it arrives by email rather than a verified phone call.

The second red flag was the domain impersonation, because officials confirmed the cyberattackers used a look-alike domain designed to pass casual inspection. Examining the sender's full email address, rather than just the display name, would have revealed the discrepancy.

The third red flag was the gap between payments and confirmation. Four monthly payments were diverted between October 2023 and January 2024 before the real vendor reported non-receipt in February, and the absence of independent payment confirmation went unnoticed for months. A mandatory verification policy requiring any payment change to be confirmed through a known phone number would have prevented the loss entirely, yet the town recovered only $3,308 of the stolen funds.

Common Threads: The Red Flags Both Incidents Shared

Despite their differences in scale and technique, the Arup and Arlington incidents share a pattern of missed BEC red flags that recurs across nearly every successful cyberattack. Both began with an unsolicited, urgent financial request from an impersonated trusted party, and both included a demand for process deviation: a secret transaction at Arup and a payment method change at Arlington.

Both also exploited email as the initial trust vector before layering additional channels to deepen the deception. And critically, both succeeded because no out-of-band verification step existed that was mandatory rather than optional.

These are not isolated events. Organizations that build mandatory verification checkpoints into payment workflows, whether a known phone number, a second approver, or a face-to-face confirmation, remove the single point of failure that cyberattackers count on. The red flags are visible before the money moves, and the difference is whether anyone is empowered and required to act on them.

Both organizations spotted the warning signs and still lost millions because verification was optional. Adaptive Security turns out-of-band verification into a reflex no deepfake can override.

Take a self-guided tour

Operationalizing BEC Red Flag Detection Across the Organization

Operationalizing BEC red flag detection means embedding verification checkpoints, platform-specific detection rules, and cross-channel correlation into daily workflows, so no single employee becomes the sole gatekeeper for a six-figure wire transfer. The starting point is mapping the email environment to the detection capabilities available, then layering on compliance-mandated controls, DMARC forensic visibility, and correlation rules. Organizations that catch BEC before money moves treat red flag detection as an engineering problem rather than an awareness campaign.

1. BEC Detection Across Cloud and On-Premise Email Environments

BEC red flags manifest differently depending on whether the organization runs Microsoft 365, Google Workspace, or an on-premise Exchange deployment. Cloud-native platforms offer detection capabilities that on-premise environments cannot replicate without significant integration work, but they also introduce attack surfaces legacy deployments never had to contend with.

In Microsoft 365, the richest detection signals come from the unified audit log and Microsoft Defender for Office 365. Mailbox forwarding rules created via Exchange Online PowerShell, inbox rule manipulations that hide replies, and anomalous SMTP authentication patterns are all detectable through Advanced Hunting queries.

According to Verizon's 2026 Data Breach Investigations Report, stolen credentials were involved in 13% of all breaches, so automated alerting on these signals is essential. Google Workspace provides comparable visibility through the alert center and investigation tool, where suspicious mail forwarding and unauthorized OAuth grants surface indicators invisible in a purely SMTP-based environment.

On-premise Exchange environments lack the API-driven telemetry that makes cloud detection powerful, so security teams must rely on SMTP header analysis, transport rule logging, and mailbox audit logging that must be enabled explicitly. Where cloud platforms can flag an impossible-travel login and correlate it with a suspicious email in milliseconds, on-premise teams often discover the connection days later during manual investigation, which is why they must invest more heavily in SIEM integration.

2. Regulatory Compliance Mandates That Require BEC Controls

BEC is not just a security problem; it is a regulatory compliance obligation spanning multiple frameworks, and regulators increasingly expect organizations to demonstrate specific controls that address payment fraud and unauthorized access.

The Sarbanes-Oxley Act (SOX) mandates internal controls over financial reporting that directly apply to payment-verification procedures. Section 404 requires management to assess the effectiveness of controls that prevent material misstatements, and a fraudulent wire transfer triggered by a BEC cyberattack can constitute exactly that. Organizations subject to SOX must document that payment-change requests undergo independent, auditable verification, because a $500,000 invoice paid on an impersonated CFO's instruction is not just a security incident but a SOX deficiency.

GDPR imposes technical and organizational measures to prevent unauthorized access to personal data, and BEC is one of the most direct paths to that access. Article 32 requires controllers to implement measures appropriate to the risk, and when a cyberattacker impersonates an executive to trick an HR employee into sending employee records, the resulting breach triggers notification obligations under Articles 33 and 34.

The New York Department of Financial Services (NYDFS) cybersecurity regulation (23 NYCRR 500) goes further by explicitly requiring multi-factor authentication and periodic risk assessments that encompass BEC cyber threats. Section 500.12 requires MFA for any individual accessing internal systems from an external network, and Section 500.09 mandates risk assessments accounting for the specific threats facing the organization. For financial institutions, a BEC detection framework absent from the risk assessment and unsupported by MFA is a compliance gap.

3. DMARC Forensic Reporting, SOAR/SIEM Integration, and Detection Benchmarking

DMARC forensic reporting (the ruf tag) provides proactive visibility into domain-spoofing BEC campaigns before they reach employee inboxes. Security teams can identify an active spoofing campaign within minutes of the first fraudulent message rather than hours later, and the fo=1 tag ensures a report is generated if either SPF or DKIM fails.

Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) integration transforms isolated BEC red flags into correlated, actionable incidents. A suspicious email from a spoofed executive domain is concerning on its own, but that same email arriving within minutes of an impossible-travel login captured by Azure AD or Okta identity logs is a high-confidence BEC cyberattack. SOAR playbooks can automate the response, quarantining related messages, revoking the suspicious session token, and alerting the SOC analyst with a pre-assembled timeline.

Benchmarking BEC detection maturity requires tracking the metrics that predict outcomes. According to Verizon's 2025 Data Breach Investigations Report, the median time to report a phishing email was 28 minutes, a reasonable starting baseline that should trend downward month over month.

Verification rate for payment-change requests must approach 100%, and phishing simulation BEC susceptibility, measured through controlled phishing simulations that impersonate executives, should be driven below 5% through targeted training. If these three metrics are not improving, the detection framework is aspirational rather than operational.

Detection rules and forensic reports mean nothing if the workforce is the gap cyberattackers walk through. Adaptive Security closes the human layer that SIEM and SOAR cannot see.

Explore the platform

Deepfakes, AI, and the Expanding BEC Threat Surface

The BEC cyberattack that reaches an inbox in 2026 rarely looks like the clumsy fraud of five years ago. Generative AI now writes flawless impersonation copy, clones voices from a conference recording, and animates a CFO's face for a live video call, which collapses the classic BEC red flags employees were trained to spot. Understanding this expanding threat surface is what separates a resilient organization from a soft target.

How AI Rewrote the Economics of Impersonation

The supply-side economics of impersonation have shifted decisively toward the cyberattacker. Freely available open-source models and low-cost tooling put high-quality executive impersonation within reach of people with no specialized background, so when attack costs approach zero and fraud yields reach six figures per incident, volume scales accordingly.

According to Sumsub's Identity Fraud Report 2025-2026, deepfake attacks increased 2,100% globally, up from the 1,740% regional surge North America recorded during 2022-2023, with sophisticated fraud including deepfakes, synthetics, and telemetry tampering rising 180% year over year. These are not projections; the growth has already happened.

The threat compounds with speed. According to the CrowdStrike 2026 Global Threat Report, average adversary breakout time, the window between initial access and lateral movement, dropped to 29 minutes, with the fastest measured at just 27 seconds. When a compromised mailbox can be weaponized for a fraudulent transfer that fast, verification cannot wait for a scheduled review.

The Awareness Gap That AI Exploits

AI does not only strengthen the cyberattack; it widens the gap on the defender's side. Employees are adopting AI tools faster than security teams can govern them, which concentrates risk exactly where visibility is lowest.

According to the National Cybersecurity Alliance's Oh Behave! The Annual Cybersecurity Attitudes and Behaviors Report 2025-2026, 52% of employed participants reported receiving no training on the security or privacy risks of AI tools, even as 65% now use AI and 43% admit to sharing sensitive work information with it. That unmanaged AI use is the same terrain synthetic media exploits.

Governance is climbing the accountability ladder in response. According to the World Economic Forum's Global Cybersecurity Outlook 2026, 52% of organizations report that board members receive regular cybersecurity updates and 48% report boards actively engaged with cybersecurity issues, with 30% of board members in high-resilience organizations holding personal liability for cyber breaches compared to only 9% in low-resilience ones. BEC preparedness has moved from a technical line item to a board-level obligation, which raises the stakes for getting the human layer right.

Deepfake voice and video now defeat the sensory cues employees relied on to trust a request. Adaptive Security builds detection instincts for the AI-driven impersonation cyberattackers deploy today.

Book a demo

How Security Awareness Training Transforms BEC Red Flag Recognition

Business email compromise cyberattacks succeed because social engineering overwhelms human judgment under pressure, not because employees lack knowledge of the warning signs. Cybersecurity awareness training closes that gap by conditioning the pause-and-verify reflex that knowledge alone cannot sustain. According to Coalition's 2025 Cyber Claims Report, BEC and funds transfer fraud accounted for 60% of total claims in 2024, with 29% of BEC incidents escalating to actual funds transfer.

Annual compliance training teaches employees to spot suspicious sender addresses and urgent payment requests, yet cyberattackers keep collecting billions by weaponizing the exact authority and urgency dynamics that slide-based training cannot simulate. The measurable shift comes from realistic practice rather than passive content.

Why Knowing Red Flags is not Enough

A finance team member can recite five BEC red flags in a workshop and still approve a fraudulent wire transfer thirty minutes later when a deepfake voice of the CFO follows up an email. Knowledge decays under pressure, because BEC cyberattacks are designed to trigger the same compliance reflexes that help organizations function efficiently under normal conditions.

The gap comes down to conditioning rather than awareness. As NIST computer scientist Julie Haney and University of Maryland Associate Professor Wayne Lutters concluded in their peer-reviewed analysis published in Computer (October 2020), compliance metrics do not tell the whole story and fail to measure a program's effectiveness in producing sustained change in employee attitudes and behaviors. A 2025 California appellate decision in Thomas v. Corbyn Restaurant Development Corp. affirmed that the payor bore responsibility for a $475,000 BEC loss after ignoring multiple red flags, including a slightly altered sender address, an inoperable phone number, and changed payment instructions.

Realistic cybersecurity awareness training rewires that response. When employees experience a BEC scenario complete with executive impersonation, tight deadlines, and multi-channel follow-up in a controlled environment, they build the pattern of pausing and verifying even when every social cue demands immediate action. The knowledge becomes instinct.

Multi-Channel BEC Simulation and Behavioral Measurement

Modern BEC cyberattacks are rarely email-only. Callback-style follow-ups weaponize the very verification reflex security teams train employees to use, which is why single-channel training no longer matches the cyberattack.

This multi-channel reality demands multi-channel phishing simulation. Adaptive Security's phishing simulation platform deploys OSINT-informed BEC scenarios across email, voice, and SMS simultaneously, mirroring how cyberattackers actually operate. An employee might receive a spoofed vendor invoice by email, then a text from "the CFO" asking if it was received, followed by a voicemail emphasizing urgency, with each channel reinforcing the illusion of legitimacy.

The phishing simulation generates behavioral data: who clicked, who reported, who hesitated and then complied, and who verified through a parallel channel. That data reveals whether red flag knowledge translates into defensive action under conditions that approximate a real cyberattack, which is the only measurement that matters.

From Red Flag Awareness to Measurable Human Risk Reduction

The output of continuous BEC phishing simulation is a risk score rather than a completion certificate. Individual employees receive scores reflecting their actual susceptibility to BEC tactics under pressure, and departments such as finance, accounts payable, and executive assistants show aggregate risk profiles that identify where BEC-specific cybersecurity awareness training is most needed. Security leaders gain board-ready metrics that demonstrate program effectiveness in dollar-risk terms instead of completion rates for training modules.

When a high-risk employee fails a BEC phishing simulation, Adaptive Security's platform automatically assigns microlearning that targets the specific red flag they missed, whether the look-alike domain, the urgency framing, or the unusual payment instructions. This closes the loop between detection failure and skill improvement in hours rather than quarters, producing a workforce where BEC red flag recognition is a trained instinct rather than a memorized checklist.

A completion certificate proves attendance rather than resistance to a live BEC cyberattack. Adaptive Security measures real susceptibility and closes each gap with targeted microlearning.

Take a self-guided tour

See How Adaptive Security Tests Your Organization's BEC Red Flag Detection

BEC cyberattacks reaching inboxes today are AI-generated, grammatically flawless, and engineered to bypass both authentication controls and surface-level awareness training. Adaptive Security positions the workforce as a measured, defensible layer against exactly these cyberattacks, rather than the weakest link cyberattackers assume it to be.

A self-guided tour of the Adaptive Security platform shows how AI-powered, multi-channel phishing simulations test detection of BEC red flags across email, voice, SMS, and deepfake channels in real time. Behavioral data replaces completion certificates, so security leaders can see who verifies under pressure and who complies, then close each gap with targeted microlearning.

The result is a workforce where recognizing BEC red flags is a trained instinct and every simulation failure becomes the raw material for a harder target.

Authentication alone cannot stop the AI-driven BEC cyberattacks that reach inboxes daily. Adaptive Security proves how a trained workforce detects them across every channel.

Take a self-guided tour

Frequently Asked Questions About BEC Red Flags

What is the Most Common Red Flag of a Business Email Compromise Attack?

The most common red flag of a business email compromise cyberattack is an unexpected request to change payment details, wire funds, or transfer money paired with manufactured urgency. FBI IC3 case data shows that most reported BEC incidents involve a cyberattacker impersonating an executive, vendor, or business partner and pressuring the recipient to bypass standard verification.

The request typically uses language such as "ASAP," "before end of day," or "while I'm in transit," and cyberattackers often insist on confidentiality while discouraging any call to confirm. According to the FBI Internet Crime Complaint Center's Public Service Announcement I-091124-PSA (2024), BEC generated $55 billion in global exposed losses between October 2013 and December 2023, making payment redirection the defining financial mechanism of this cyberattack. Any unsolicited request to alter payment instructions should trigger immediate out-of-band verification through a known, pre-existing contact method.

How can Employees Verify Whether an Email Requesting a Payment Change is Legitimate?

Employees should verify any payment-change request through an out-of-band channel using contact information the organization already has on file, never phone numbers or links contained in the suspicious email itself. The FBI recommends calling the purported sender at a known, pre-existing number or confirming the request in person, and never replying to the email.

For vendor payment changes, employees should contact the established point of contact through the vendor management system or original onboarding records, and for executive requests, walk to the office or call the direct line. Organizations with mandatory verification protocols experience significantly fewer successful BEC incidents than those relying on email-based confirmation alone, which is why out-of-band authentication is consistently cited as one of the most effective controls for stopping BEC-driven financial loss.

Can DMARC, SPF, and DKIM Completely Prevent BEC Attacks From Reaching Employee Inboxes?

No. DMARC, SPF, and DKIM cannot completely prevent BEC cyberattacks from reaching employee inboxes. These authentication protocols are designed to stop direct domain spoofing, where a cyberattacker forges the envelope-from domain of a legitimate organization.

Most BEC cyberattacks bypass these controls using tactics authentication cannot address: look-alike domains registered minutes before the cyberattack, display name spoofing where only the visible name is faked, free webmail accounts claiming to be an executive, and compromised legitimate mailboxes that send fully authenticated messages. According to the FBI Internet Crime Complaint Center's Public Service Announcement I-091124-PSA (2024), BEC cyberattackers increasingly operate from compromised accounts that pass all SPF, DKIM, and DMARC checks. Authentication is an essential baseline layer, but it must be paired with cybersecurity awareness training that conditions staff to recognize the behavioral red flags authentication cannot catch.

What Should an Employee do Immediately After Spotting BEC Red Flags in an Email?

An employee should take three immediate steps. First, do not reply, click any links, download attachments, or engage with the email in any way. Second, report the email through the organization's designated mechanism, whether a "report phishing" button, a SOC ticket, or notification to the IT security team. Third, if the email impersonates a colleague or executive, contact that person directly using a known phone number to alert them their identity is being spoofed.

If a financial transfer was already completed, the FBI directs victims to contact their financial institution immediately to request a recall or freeze, then file a complaint at ic3.gov. The FBI's guidance emphasizes that reporting within the first 24 to 48 hours meaningfully improves the odds of recovering funds, because recovery depends on rapid coordination between financial institutions before the money is withdrawn.

How are AI and Generative Tools Changing the BEC Red Flags Organizations Need to Watch For?

AI and generative tools are systematically eliminating the classic linguistic red flags, including poor grammar, awkward phrasing, and spelling errors, that employees have been trained to spot for years.

According to Columbia Engineering research reported in July 2025, 51% of all spam emails are now AI-generated, though that figure measures spam broadly and is not directly comparable to the BEC-specific rate. Detection must therefore shift from language quality to contextual and procedural red flags: requests that bypass normal approval chains, subtle deviations from corporate communication norms, and factual errors about internal processes. Organizations that keep training employees to rely on grammar and spelling as primary detection cues are operating against an outdated threat model.

Every BEC red flag in this guide is only useful if the workforce acts on it under pressure. Adaptive Security turns recognition into a measured, trained reflex across every channel cyberattackers use.

Explore the phishing simulations platform