Business Email Compromise Tabletop Exercise: A Practical Playbook for Testing Payment Fraud Response and Recovery

Key takeaways

• A business email compromise tabletop exercise tests decisions, authority, and handoffs without moving money or touching production systems.
• Realistic scenarios use the organization's own payment workflow, approval thresholds, vendor relationships, and communication habits, because familiar context exposes more gaps than technically elaborate cyberattack mechanics.
• Out-of-band verification through an independently sourced contact is the control the exercise must test hardest, since a compromised mailbox produces authentic headers and genuine message history.
• Recovery depends on speed, so the exercise should measure time to detect, time to escalate, and time to contact the bank. Funds become harder to freeze as they move through intermediary accounts.
• Every finding needs one accountable owner, a due date, required evidence, and a retest in a later exercise, because closing a document is a weaker signal than repeating the performance.

Want more from Adaptive in your Google results?

Business email compromise drove $3.05 billion in reported U.S. losses across 24,768 complaints in 2025, according to the FBI IC3 Internet Crime Report 2025. A business email compromise tabletop exercise tests the response to that kind of fraud before an actual incident does. The exercise exposes gaps across finance, security, legal, executive leadership, procurement, and communications.

Those gaps range from weak out-of-band verification to unclear bank contacts, missing evidence, and unavailable decision-makers. The sections below cover how to build realistic scenarios involving executive impersonation, supplier fraud, compromised mailboxes, AI-generated phishing, and deepfake identity attacks. The format stays nonpunitive and focuses on systems and decisions.

The guide also covers escalating injects, evidence preservation, account security, notifications, response measurement, and the control, playbook, and employee-training improvements that follow.

The CISA Tabletop Exercise Packages provide objectives, discussion prompts, and after-action templates that this guide adapts to payment fraud. By the end, a security leader can run a repeatable exercise that strengthens payment controls and prepares finance staff to challenge urgent requests.

Ready to see where payment fraud exposure actually sits? Measure human risk across finance and executive workflows with Adaptive Security.

What Is a Business Email Compromise Tabletop Exercise?

A business email compromise tabletop exercise is a facilitated, discussion-based test of how an organization detects, verifies, escalates, contains, investigates, reports, and recovers from business email compromise (BEC). It brings security, finance, legal, executive, communications, and banking stakeholders together to make decisions during a realistic scenario. No funds move and no production system is disrupted.

The exercise stays nonpunitive throughout. It tests whether systems, policies, and handoffs work under pressure, and it does not grade individual employees.

What Does a BEC Tabletop Exercise Cover?

A BEC tabletop exercise follows a staged incident, such as a spoofed executive request to change vendor payment instructions. The facilitator releases information through timed updates. Participants then say what they would do, whom they would contact, and what evidence they would preserve. The scenario should cover the response path from the first suspicious message through financial recovery and post-incident review.

The scope includes email reporting, identity verification, payment approval controls, escalation routes, bank contact procedures, legal obligations, executive communications, forensic investigation, and recovery.

Participants should determine whether they can identify affected accounts, freeze or recall a transfer, and preserve message headers and transaction records. They should also confirm that they can brief leadership and maintain normal operations while the investigation continues.

The CISA Tabletop Exercise Packages provide a planning framework with customizable objectives, scenarios, discussion questions, facilitator materials, and after-action reporting templates. Organizations can adapt that structure to their payment workflows, banking relationships, approval thresholds, and regulatory environment, which produces a sharper test than a generic phishing discussion.

What Are the Learning Objectives and Success Criteria of a BEC Tabletop Exercise?

The exercise should produce measurable answers. Broad assurances that the team "handled it well" give leadership nothing to act on. Participants should settle who can pause payments and whether investigators can reconstruct the cyberattacker's actions from preserved evidence.

Success criteria should include decision quality under incomplete information, time to detect, time to escalate, time to contact the bank, continuity of critical payment operations, and evidence handling.

A strong exercise also exposes conflicting procedures. Finance might believe the security team can freeze a transaction, while the bank requires an authorized treasury contact. Finding that gap during a controlled discussion gives the organization time to assign ownership and document a reliable call tree.

The facilitator should judge the process. Punishing an individual who misses a clue teaches the room to stay quiet. A participant who asks for independent verification or challenges an urgent request demonstrates the behavior the exercise is designed to reinforce.

If the team makes a poor decision, the debrief should identify which signal, policy, approval step, or communication channel failed. It should then define a corrective action with an owner and a deadline.

Organizations can pair tabletop findings with phishing simulations so employees rehearse the individual judgment call. The tabletop tests coordination, while phishing simulation results show whether employees recognize and report the same cyberattack pattern.

How Does a Tabletop Differ From Other Exercise Types?

A tabletop is a discussion, so participants execute no test code, send no controlled traffic, and alter no live systems. That separates it from a control validation test, which exercises the controls themselves.

A penetration test differs because it identifies exploitable weaknesses through authorized technical probing. A purple-team exercise also differs: offensive and defensive security teams collaborate in a controlled environment to test detection and response against simulated cyberattacker activity.

The distinction matters because each exercise answers a different question. A control validation test checks whether controls generate and route the right signals. A penetration test tests whether a cyberattacker can exploit a weakness. A purple-team exercise tests how defenders detect and contain adversary techniques.

A BEC tabletop tests something else entirely. It asks whether people and processes support sound decisions when an apparently legitimate payment request creates financial pressure. Organizations that want the underlying cyberattack mechanics first can review how BEC attacks work before designing the scenario.

Used together, these methods create stronger coverage. The tabletop identifies unclear authority, missing contacts, and contradictory procedures, while technical exercises validate the supporting controls.

How Should Organizations Design a Realistic Business Email Compromise Scenario?

A realistic scenario for a business email compromise tabletop exercise should mirror the organization's payment workflow, trusted relationships, approval limits, and communication habits. Build one plausible cyberattack narrative, map the decisions a cyberattacker would exploit, then add timed injects involving payment changes, mailbox compromise, executive pressure, and recovery.

Keep the exercise focused on human decisions and business continuity. A specific security technology is a secondary concern here.

1. Select a Cyberattack Narrative That Matches the Organization

Start with a business event employees already understand. Choose a pending equipment purchase, supplier renewal, acquisition payment, payroll change, or international invoice, since an abstract suspicious-email exercise teaches far less.

Identify the expected sender, the employee receiving the request, the payment system involved, and the business consequence of delay.

Use the organization's terminology and approval chain. If the company calls its procurement platform a purchase-to-pay system, use that name. If finance confirms vendor changes by phone, include that step. If executives routinely send urgent requests through mobile messaging, reflect that behavior. Realism comes from familiar context, and technically elaborate cyberattack mechanics add little.

Build the narrative around one of these entry points:

• An executive impersonation request that appears to come from the CEO, CFO, or regional president.
• A supplier impersonation attempt that changes bank details on a legitimate invoice.
• A compromised vendor mailbox containing genuine correspondence, contracts, and invoice history.
• A genuine executive mailbox compromise in which the cyberattacker reads existing threads and replies at the right moment.

The scenario should test verification procedures, account-compromise detection, and the response after fraudulent funds move. The exercise should require participants to decide who can pause a payment, contact the bank, preserve evidence, notify the supplier, and brief leadership.

Give the scenario a credible reason for urgency. A shipment could be waiting at a port, a project crew could be idle, a foreign-exchange window could close that day, or a supplier could threaten to suspend service. Pressure explains why a reasonable employee might prioritize speed.

The objective goes beyond catching someone in an obvious mistake. The exercise tests whether the process supports careful decisions when a request looks credible. Reviewing documented business email compromise examples helps planners choose a narrative that matches real loss patterns.

2. Tailor the Scenario to the Organization's Risk Profile

Replace generic assumptions with the organization's actual exposure. A manufacturer might face a fraudulent payment for specialized equipment. A health system might receive a request to redirect a medical supplier payment. A university could face a compromised research-partner mailbox. A professional-services firm might be targeted through a client trust account or international settlement.

Map the scenario to the roles that authorize, prepare, release, and reconcile a payment. Include accounts payable, procurement, treasury, the business owner, the service desk, security, legal, communications, and the relevant executive.

Invite the executive whose identity is being impersonated, but withhold advance access to every inject. How staff behave with that executive in the room reveals whether they can verify an urgent request without deferring to authority.

Financial institutions need scenarios that reflect correspondent banks, sanctions screening, dual approval, and recall procedures. Multinational organizations should include international wires, local payment platforms, time-zone gaps, and multiple currencies.

For illustration, a request to send $780,000 in U.S. dollars to a new account differs from a €640,000 payment routed through a correspondent bank, and both differ from a same-day payment in Japanese yen. Those distinctions determine which teams act, what records exist, and how quickly a recall can begin.

Use the access that staff actually have today, including the devices, approval tools, and mailbox permissions they use. If finance staff approve payments through a browser, make the scenario involve that workflow. If executives use mobile devices while traveling, include a mobile reply or phone call. If the company relies on Microsoft 365 or Google Workspace audit records, identify who can retrieve them.

Connect the exercise to phishing simulations covering BEC and multi-channel social engineering, while keeping the tabletop focused on decisions and coordination. Product evaluation belongs in a separate technical review.

3. Set a Payment Amount and Constraints That Force Decisions

Avoid a universal dollar threshold for a BEC exercise. Set the amount by reviewing the organization's normal transaction range, executive approval limits, cash position, vendor concentration, and tolerance for operational disruption. The payment should be large enough to trigger concern and plausible enough to occur in ordinary work.

A regional operations director could receive an email that appears to come from the CFO. The message says a supplier changed its receiving bank because of an audit issue and asks accounts payable to release $780,000 before a shipment deadline. The invoice references a real purchase order, uses the correct supplier name, and arrives in an existing email thread.

Add constraints that force the group to apply its process:

• The CFO is traveling and cannot immediately answer on the usual corporate number.
• The supplier's known account manager confirms that the shipment is urgent but will not confirm the bank change.
• The payment requires two approvals, but one approver is on leave.
• The receiving account is in another country and uses a different currency.
• A correspondent bank places the transfer in a review queue.
• The cyberattacker sends a second message claiming that a failed payment will stop production.
• A legitimate supplier mailbox contains the earlier invoice and contract, making the fraudulent change harder to identify.

Allow some controls to fail. If the group says it will call the supplier, provide the altered email's phone number and ask how participants will locate a trusted number. If it says the bank will recall the payment, ask who has authority to initiate the recall and what information the bank requires.

These injects expose undocumented dependencies while keeping blame out of the room.

4. Add AI Impersonation as a Decision Problem

AI-generated phishing, voice cloning, and deepfake identity attacks should increase uncertainty without becoming a technology demonstration. Give participants a believable reason to receive a voice message or video call. Then test whether the verification rule changes when the voice and face appear authentic.

After a finance employee questions the invoice change, a voice message could arrive from the CFO confirming the request. A short video meeting could follow, appearing to include the CFO and project director. Participants must decide whether a familiar voice or face is sufficient authorization. A convincing rendering of either does not establish who sent the request.

Require an independent callback, a pre-established code phrase, an approval in the payment system, or another trusted control that avoids the same compromised channel. Planners can draw scenario detail from published AI-powered business email compromise tradecraft.

The Arup case shows the financial stakes. Criminals used a deepfake video meeting to persuade an employee to transfer approximately $25 million, according to CNN's May 2024 report.

A separate 2024 incident, reported by NBC News, shows how convincing video impersonation can be: an individual posing as former Ukrainian Foreign Affairs Minister Dmytro Kuleba targeted U.S. Sen. Ben Cardin in a video call. Use these cases as context while keeping the exercise grounded in the organization's communication patterns.

Run the scenario across channels. While finance investigates the invoice, a fake supplier could send an SMS, a cyberattacker could call the treasury analyst, and a compromised executive mailbox could forward a legitimate contract. This tests whether teams share signals or investigate each message in isolation. Teams unfamiliar with multi-channel pressure can review the differences between vishing and smishing during preparation.

5. Run the Exercise Through Payment, Containment, and Recovery

Release the scenario through timed injects. Presenting the entire cyberattack at once removes the decisions the exercise exists to test. Begin with the invoice change, introduce the executive confirmation, reveal the mailbox compromise, announce the attempted transfer, and disclose the bank's response.

At each stage, ask who owns the decision, what evidence is needed, which system records the action, and who must be informed.

The exercise should end only after the group addresses payment recall, account containment, mailbox investigation, supplier verification, executive communications, legal review, regulatory obligations, and employee follow-up.

Record the time required to detect the fraud, stop or recall funds, establish a trusted communication path, and preserve evidence. Success means a readiness score against pre-set targets plus assigned corrective actions. Identifying the cyberattacker's technique is only the starting point.

Convert every gap into an owner, a deadline, and a testable change.

Actions might include requiring independent verification for new bank details, documenting correspondent-bank contacts, or rehearsing a deepfake-resistant executive callback process. A realistic scenario cannot predict every cyberattack path, but it can show whether the organization makes safe payment decisions when familiar signals push employees to move quickly.

Who Should Participate in a Business Email Compromise Tabletop Exercise?

The roster should include the people who can validate a payment request, stop a transaction, preserve evidence, notify affected parties, and approve recovery actions. Assign one incident commander, separate exercise-control roles from decision-makers, and include owners of finance, technology, legal, communications, and business operations.

Test the roster with key leaders unavailable. An exercise that works only when the CFO or IT lead is present has not tested operational resilience.

1. Assemble the Core Decision-Making Team

The core team should represent every function that must act during payment fraud. The incident commander directs the response, sets priorities, and records decisions without owning every task.

The security or IT lead validates account compromise, reviews authentication and mailbox activity, preserves logs, and coordinates technical containment. The finance or treasury lead verifies payment instructions, contacts the bank, freezes or recalls funds, and confirms which approvals remain valid.

Legal and compliance determine notification duties, privilege boundaries, regulatory exposure, and evidence-handling requirements. Communications prepares internal and external messages so employees, customers, regulators, and journalists receive consistent information.

HR supports employee communications and access changes when an employee is impersonated, targeted, or involved in the transaction. Business-unit owners and procurement explain the vendor relationship, contract, purchase order, and approval chain the cyberattacker exploited.

Keep the group small enough to make decisions quickly, and include every process owner who controls money or information.

2. Separate Exercise-Control Roles From Participants

The facilitator runs the exercise without rescuing the team from difficult decisions. They introduce the scenario, deliver timed injects, challenge assumptions, and keep the discussion on incident decisions. Technical troubleshooting belongs in a different session. Participants make decisions as they would during an actual incident.

An evaluator watches for measurable outcomes, including how long the team takes to verify the beneficiary, whether it identifies an out-of-band verification path, and who can authorize a payment hold.

A note-taker records decisions, owners, deadlines, unresolved questions, and policy gaps. Observers from internal audit, risk, or business continuity can attend silently, though they should never influence play.

Use an external facilitator when internal teams struggle to challenge executives, the organization has never rehearsed fraud response, or legal and business units disagree about authority. Use fictional or sanitized case data only. Real account numbers, employee records, vendor banking details, and privileged legal advice belong outside the exercise room.

3. Include Executives and Test Unavailable Approvers

The CEO does not need to attend every session, though participation is appropriate when the scenario involves public disclosure, material financial loss, customer impact, or contact with law enforcement. The CFO should participate when treasury controls, payment release, bank escalation, or financial reporting are in scope.

If either executive is unavailable, appoint an alternate decision-maker before the exercise and document that person's authority.

Test the arrangement directly by announcing that the CFO is unreachable, the IT lead is traveling, or the incident commander has lost access to corporate systems. Require the alternate to approve or reject the payment hold, bank call, customer notification, and evidence-preservation plan.

Absent leaders should make no decisions through side conversations. Those conversations conceal the approval gap the exercise is designed to expose.

4. Add External Parties as Controlled Injects

Banks, insurers, outside counsel, forensic providers, vendors, and law enforcement usually belong in the exercise as scripted injects or observers. Full participation complicates scheduling and dilutes the internal decisions under test.

A facilitator can introduce a bank call stating that a recall window is closing, an insurer requesting an incident timeline, outside counsel requesting preserved evidence, or a vendor disputing changed account details. These prompts test whether the internal team knows who can speak for the organization and what information it can release.

Use fictional names, sanitized reference numbers, synthetic email excerpts, and recreated account details, while keeping the payment amount at the level the scenario design set. Give external observers a confidentiality briefing and limit their access to the exercise room and materials.

Finish the design phase by assigning an owner to each remaining scenario choice: the payment amount, the impersonated executive, the vendor relationship, and the communication channel. Those choices determine whether the exercise can test the written response plan.

How Should a Business Email Compromise Tabletop Exercise Test Payment Verification and Approval Controls?

Finance teams need to stop, verify, and escalate before funds move. Walk through the request from the initial message to bank release, adding pressure, conflicting instructions, and an additional fraudulent payment to test whether controls hold.

Treat every failure as a process gap to repair, because labeling it an employee failure teaches the room to hide mistakes. Record the owner, decision time, and evidence required at each control point.

1. Require Out-of-Band Verification Through an Independently Sourced Contact

The opening control is independent verification of every high-value wire, vendor bank-account change, or unusual payment instruction. Present a request that appears to come from the chief financial officer, a supplier, or a senior account executive.

Require the payment operator to use a trusted channel already held in company records. Acceptable sources include the vendor master file, a known internal directory, or a previously validated contract contact.

The participant must avoid the phone number, reply address, QR code, or hyperlink contained in the suspicious message. This restriction matters because a cyberattacker controls every contact detail inside the message and can route the verification directly back to the fraud.

Test both common cyberattack conditions. A spoofed sender uses a deceptive display name or lookalike domain while the genuine mailbox remains under the owner's control. A genuinely compromised mailbox is an authentic account controlled by a cyberattacker, allowing the message to pass normal sender checks and appear inside an existing conversation.

A compromised mailbox is especially dangerous because familiar message history, signatures, and trusted domain indicators create false confidence. The verification rule must apply even when the email originated from the genuine executive or supplier account. The email account takeover attack lifecycle explains how that access is established and maintained.

Require the participant to call an independently sourced contact and ask a question the cyberattacker cannot answer from the message thread. A compromised mailbox holds the invoice history, so the analyst should ask about facts that live outside it.

Useful questions cover who authorized the change internally at the vendor, which approval record documents it, and what the vendor's own controller says about the account. A callback to a number copied from the email does not count as verification.

If the vendor contact cannot be reached, the payment remains on hold while the analyst escalates to the designated treasury or finance manager. A substitute contact, verbal reassurance, or an urgent business deadline should never override the hold.

Introduce an executive-account compromise during the exercise. The actual CFO confirms that the request was unauthorized, but the cyberattacker has already created a forwarding rule and deleted several replies. Participants must decide whether to disable the mailbox, revoke active sessions, reset authentication factors, and review recent payment instructions.

Document the callback procedure in operational terms. Specify who makes the call and which number or directory entry qualifies as trusted. Also specify which questions must be asked, how the confirmation is recorded, and what happens when the contact does not answer.

Test a callback failure deliberately. A busy vendor line, an international time-zone gap, or an employee who says, "The CFO approved it in the email," should trigger a hold. A workaround at that moment defeats the control.

2. Test Dual Approval and Segregation of Duties Under Pressure

Payment approval controls work only when the second approver performs an independent check. Require one employee to prepare the payment and a different authorized employee to validate the request, beneficiary details, amount, and business purpose. Verbal reassurance during the handoff is no substitute for evidence.

Create an approval matrix before the session. Identify who can approve domestic payments, international transfers, new beneficiaries, urgent exceptions, and payments above each threshold. Include deputies for absences. Prohibit self-approval, approval by the requester, or approval by anyone who edited the vendor record.

Participants should state the escalation threshold aloud, including the amount or risk condition that requires treasury, the controller, the chief financial officer, or an executive crisis lead. The exercise should expose whether employees know the authority path before pressure makes improvisation more likely.

Apply realistic pressure. Tell the group that payroll, a property closing, or a critical supplier shipment will fail if the transfer does not leave within 20 minutes. Add a message from the allegedly compromised executive instructing the team to bypass the usual approval chain.

The correct response is to preserve the payment hold and escalate through the documented authority path. An emergency label may compress the response time, but the approval standard still applies.

Test compromised mobile devices and authentication methods as well. Give the scenario a stolen phone, a cyberattacker with a session token, or a push notification that the executive approved without reading. Participants should determine whether they can suspend the account, revoke sessions, invalidate recovery codes, and confirm the executive's identity through a separate channel.

An approved multifactor prompt confirms that someone completed an authentication step. The prompt does not show whether that person is authorized to change a beneficiary. Teams should understand common MFA bypass attacks before relying on a prompt as confirmation.

Record where segregation fails. Common gaps include one treasury employee who creates vendors and releases payments, a manager who approves requests from a shared mailbox, or a finance system that permits one person to modify bank details and approve the resulting transfer.

Connect the findings to phishing simulations that test BEC and vendor impersonation so employees rehearse recognition and reporting behavior before a fraudulent payment request arrives.

3. Set Payment Limits and Rehearse Exception Handling

Payment limits must be specific enough to guide action during uncertainty. Define separate thresholds for routine invoices, new beneficiaries, account changes, international transfers, and payments involving correspondent banks. A new account should require enhanced verification regardless of the amount, because changing the destination can redirect later payments.

Open with a request just below the normal approval threshold, then add a second request that exceeds it. Participants must recognize the pattern, since evaluating each transfer in isolation hides the campaign.

Reveal that the earlier payment was fraudulent. Then test whether the organization freezes related payments, searches for additional requests, contacts the bank, and preserves evidence before the cyberattacker moves more funds.

Exception handling needs its own decision record. Ask participants to document who authorized the exception and why the normal process could not be followed. The record should also capture which compensating verification occurred, when the payment hold expires, and who reviews the transaction afterward.

"The CEO approved it" fails as an exception record. The record must identify the approval authority, verification evidence, and specific risk accepted.

International transfers require additional pressure points. The receiving bank may be in another jurisdiction, a correspondent bank may control intermediary messaging, and recovery windows may depend on local banking hours.

Participants should identify who contacts the originating bank and who requests a recall or freeze. They should also name who coordinates with the correspondent bank and who preserves the transaction reference, beneficiary details, and message timestamps.

Test the bank-response problem directly. Ask participants what they do when the bank cannot confirm whether the funds remain recoverable. Ask which executive owns the decision to escalate, and how the organization communicates with law enforcement, insurers, and affected vendors.

Close the exercise by asking the team to state the hold, callback, and recovery actions in sequence. The expected path is clear: stop the payment, preserve message and transaction evidence, and verify through an independently sourced contact. The team should then escalate according to the authority matrix, isolate compromised accounts, and contact the bank immediately if funds moved.

These controls give staff a fixed process to follow when a cyberattacker's timing, impersonation, and message history push them to skip steps. Organizations building the surrounding control set can review practical steps to prevent business email compromise.

Which Injects Should a BEC Tabletop Exercise Introduce as the Situation Escalates?

A BEC tabletop exercise should begin with a credible AI-generated spear-phishing email or invoice-change request, then increase uncertainty, financial exposure, and communications pressure in controlled stages. Introduce one inject at a time, require participants to classify the event, identify the decision owner, and document every internal and external notification.

Keep the exercise focused on decisions, because theatrical surprises produce stories with no corrective actions attached. The goal is an escalation path that still works when normal communication channels fail.

1. Open With a Suspicious Event Before Declaring an Incident

The initial inject should resemble a request employees routinely receive. Send the finance team an AI-generated spear-phishing email that appears to come from a trusted executive or vendor and asks for an invoice bank-account change before a payment deadline.

Include enough accurate context from public information, or open-source intelligence (OSINT), to make the request plausible while leaving the fraud signals available to anyone who looks for them.

The facilitator should pause after the initial report and ask three questions. What signals make this suspicious? Who owns the validation step? Does the organization classify it as a suspicious event, a confirmed incident, or a lower-severity issue such as ordinary spam?

Participants should reach those answers themselves. The exercise exists to expose whether the team has a shared threshold for escalation.

Require the reporting employee, finance lead, and security lead to state their actions aloud. The employee should preserve the message, avoid replying, and report it through the approved channel. Finance should pause the requested change and verify the vendor through a trusted contact already on file.

Security should examine the sender, authentication results, mailbox activity, and related messages before declaring compromise. The exercise should reward cautious reporting. Punishing an employee for asking for help removes the early warning the program depends on.

A BEC tabletop exercise supports this inject structure by defining objectives, assigning roles before the event, and capturing decisions as they occur.

A phishing simulation program can reinforce the exercise by giving employees controlled practice with the signals discussed in the room.

2. Escalate From Suspicion to Financial Exposure

The second inject should remove the comfort of a near miss. Tell participants that the requested payment was already released two hours earlier, because an accounts-payable employee applied the changed bank details without completing a callback. The bank has not confirmed whether the funds can be recalled.

Ask who has authority to contact the bank, who freezes related payments, and who determines whether the event is now a confirmed incident.

Introduce a second suspicious transfer involving a different vendor and amount. The request arrives from another employee's account, creating uncertainty about whether the organization faces one compromised mailbox, multiple compromised accounts, or a coordinated campaign. Participants must identify which facts are known, which are assumed, and which require immediate verification.

Require a decision log with four fields: current classification, evidence supporting it, decision owner, and next review time. A team that labels everything an incident loses proportionality, while a team that treats every warning as routine creates delay.

The exercise should test whether leaders can designate the released payment as a confirmed BEC incident while treating the second request as a suspicious event pending validation.

Reveal that the vendor's mailbox was compromised. A vendor contact confirms that the bank-account change did not originate with its finance team, but the cyberattacker used a legitimate mailbox thread and copied genuine invoice details.

Participants must decide whether to notify the vendor's security team, suspend payments to that vendor, review other recent transactions, and search for similar instructions across business units.

Add suspicious forwarding rules in the finance employee's mailbox. The rules send messages containing terms such as "invoice," "wire," or "payment" to an external address and move replies out of the inbox.

IT must determine whether to disable the account, revoke active sessions, preserve evidence, and search for related persistence. Legal and compliance should advise on evidence handling, contractual duties, and notification thresholds while leaving technical containment to the responders who own it.

3. Test Escalation When the Decision-Maker Is Unavailable

The third phase should test the organization's approval structure. Make the chief financial officer unavailable during travel and place the usual incident commander in another meeting. Require participants to identify who can authorize a payment hold, bank recall, customer notification, or public statement.

If the answer depends on one executive, the exercise has found a continuity gap.

The communications plan should name internal recipients and decision rights before pressure peaks. Executives need a concise business-impact update, finance needs payment status and bank instructions, and IT and security need account and mailbox actions.

Legal and compliance need facts, timelines, and potential obligations. Communications needs an approved holding statement. HR should prepare guidance for affected employees and managers, especially if an account must be disabled or an employee becomes the subject of questions.

External notification should be equally explicit. The bank may need transaction details and recall instructions. The compromised vendor needs verified contact information and a clear payment hold. A customer may require notice if its funds, data, or relationship is implicated.

The cyber insurer may require prompt notice through a designated channel. Regulators, law enforcement, and outside counsel should be considered according to the facts, jurisdiction, and policy, though announcing the exercise externally merely because the scenario is severe serves little purpose.

CIS and MS-ISAC's Cybersecurity Tabletop Exercise Guide emphasizes defined roles, structured facilitation, and after-action improvement. Apply that standard by recording what participants decide, who had authority, which information was missing, and how long each decision took.

Introduce an angry vendor or customer who demands an explanation and threatens to terminate the relationship. Follow it with a reporter asking whether the company lost money in a wire-fraud incident.

Participants must route both inquiries to the approved communications owner. No employee should speculate, confirm unverified amounts, or share investigative details from a personal account.

4. Continue the Exercise When Communications Fail

The final inject should remove the channels teams rely on most. Email becomes unavailable after IT contains the compromised environment. The instant-messaging platform is suspended because administrators cannot verify whether cyberattacker sessions remain active.

The organization must switch to preapproved alternatives such as phone trees, conference bridges, text messages, an emergency notification platform, or an out-of-band collaboration space.

Require the group to approve a short internal message before sending it. The message should state what happened, what employees must do, what they must avoid, and where updates will appear. A second message should address vendors and customers while withholding unverified facts.

Establish who drafts, who reviews for legal and regulatory risk, who approves release, and who maintains the authoritative timeline.

The exercise should end with a recovery decision, since a declaration of victory leaves the after-action report thin. Participants must state when payment activity resumes, which mailbox and identity checks remain in place, how affected accounts are monitored, and who confirms that vendors have returned to trusted payment instructions.

They should also identify which injects exposed unclear ownership, missing contact details, weak alternate channels, or inconsistent incident classifications.

Close with an after-action review while decisions remain fresh. Separate policy failures from execution failures, assign an owner to every corrective action, and set a due date for retesting.

Use those findings to design a harder follow-up exercise on the weakest processes and contacts.

How Should Teams Investigate and Contain a Business Email Compromise?

The discussion should move teams through a disciplined sequence: scope the indicators, secure identities and endpoints, preserve evidence, assess data exposure, and coordinate notifications.

In a live incident, investigators must separate immediate containment from forensic preservation, because a rushed password reset or device shutdown can destroy useful evidence. Treat the tabletop as a discussion of decisions and authorities. It grants no permission to conduct forensic work without current legal review, privacy review, and qualified forensic oversight.

1. Scope the Compromise and Identify Connected Exposure

Establish the incident boundary from the first credible signal. That signal could be a fraudulent payment request, a customer reporting a suspicious message, an unfamiliar inbox rule, a failed login notification, or an employee reporting that credentials were entered into a suspicious site.

Record the discovery time, affected user, business process, suspected cyberattacker objective, and actions already taken. Assign an incident lead, technical investigator, legal contact, and business owner before multiple teams begin changing accounts or deleting messages.

Identify the likely entry point without blaming the employee. Ask whether the person opened an unexpected document, followed a link, entered credentials, approved an MFA prompt, downloaded software, used a personal device, or noticed unusual browser behavior.

Search the mailbox and relevant security systems for the suspected URL, message ID, subject line, sender address, reply-to address, document name, attachment name, file hash, and related domains. Search delivered and deleted messages, because cyberattackers often remove evidence or use compromised accounts to send follow-on fraud.

Turn each confirmed indicator into an environment-wide search. Query for the same URL, message ID, subject, document name, hash, sender infrastructure, and domain across mailboxes, email security logs, endpoint telemetry, and identity records.

Review login locations, originating IP addresses, concurrent sessions, browser fingerprints, device identifiers, authentication failures, and successful MFA events. Compare unusual activity with the employee's normal pattern and with other accounts showing the same infrastructure.

Review identity changes that can preserve cyberattacker access. Search for newly created users, delegated permissions, mailbox delegates, application registrations, OAuth grants, connected applications, forwarding rules, and administrative changes that lack an identified owner. Record the evidence supporting each finding and distinguish confirmed activity from an investigative hypothesis.

Scoping must include cloud storage and shared data alongside email. Review access to OneDrive, Google Drive, SharePoint, shared mailboxes, collaboration spaces, and file servers for the affected identity and delegated accounts.

Identify files viewed, downloaded, synchronized, shared externally, renamed, or deleted during the suspicious period. Check link-sharing changes, new guest users, unusual bulk access, and access through unfamiliar applications.

Classify the accessed data and document its owners. Record whether it contained personal, financial, health, regulated, or confidential information, and whether the cyberattacker viewed, downloaded, copied, or shared it.

Recovery and notification both run on deadlines, so the scoping work that identifies affected accounts and data has to start early.

2. Secure Accounts, Sessions, and Endpoints Without Destroying Evidence

Containment should stop continued access while preserving the facts needed to understand the incident. Preserve the key evidence first, including the original message with full headers and the sign-in logs, then reset the affected email password and reset or disable passwords for associated applications and services.

Revoke refresh tokens, access tokens, active sessions, remembered browsers, app passwords, API keys, and connected-account authorizations. Remove suspicious OAuth grants and application consents, review delegated mailbox access, and force fresh authentication through approved identity controls.

A password change leaves cyberattacker access intact when a stolen session token or connected application remains valid.

Decide whether to suspend the account based on current risk, business impact, and evidence-preservation needs. Suspend it immediately when the account is actively sending fraudulent messages, downloading sensitive material, creating accounts, or showing persistent unauthorized access.

If the user is a critical operator, preserve business continuity through a clean replacement account and leave the suspected identity inactive. Document who approved suspension, what access was removed, when it occurred, and which services were included.

Contain endpoints according to the suspected mechanism. If malware, credential-stealing software, or browser-session theft is possible, isolate the workstation from the network while keeping it powered on. Shutdown is appropriate only when safety, legal direction, or active destructive behavior requires it.

Powering off can remove volatile evidence such as memory-resident processes, active network connections, encryption keys, and live session data. Capture volatile information only under an approved forensic procedure.

Avoid casually browsing the system, running cleanup tools, deleting files, or allowing the employee to continue working on the device before investigators determine what must be preserved.

The National Institute of Standards and Technology (NIST) Guide to Integrating Forensic Techniques into Incident Response (SP 800-86, 2006) emphasizes preserving digital evidence as part of incident response, and NIST SP 800-61 Revision 3 (2025) provides current incident response guidance. Qualified forensic personnel should determine the collection order and explain the limits of the resulting conclusions.

Analyze suspicious files through hashes before distributing or executing them. Preserve the original sample, calculate a cryptographic hash, document the tool and timestamp, and submit the hash to a reputable analysis service according to the organization's data-sharing policy.

Confidential documents, personal data, and samples that may embed either require approval before any upload to a public service, since public analysis services make uploaded samples and submission details visible to others, including a cyberattacker who monitors them. A known hash can accelerate classification, though an unknown result leaves the safety of a file undetermined.

Block confirmed malicious hashes and related indicators in endpoint and email controls, then monitor for variants, because a block keyed to one exact hash will pass the next sample. Block URLs, domains, sender infrastructure, and message IDs in the appropriate email and identity controls, and preserve copies before remediation.

Notify external organizations when their account, domain, or user appears connected to the incident. Coordinate notification with legal counsel when it could trigger contractual, regulatory, insurance, or law-enforcement obligations.

If a supplier, customer, or financial institution received fraudulent instructions, use a trusted contact path. A reply to the compromised thread reaches the cyberattacker. Finance and legal teams should document the time of the request, payment status, recipient account, recall attempts, and bank contacts, because those details determine recovery options.

3. Preserve Evidence, Privacy, and Decision Authority

Evidence preservation begins before eradication. Export malicious emails in their original format with complete headers, retain relevant authentication and audit logs, and preserve mailbox and cloud-storage activity.

Protect endpoint images, memory captures, malware samples, backups, and snapshots. Store copies in access-controlled locations separate from ordinary user accounts. Record the collector, collection method, date, time zone, source system, hash, and every transfer.

That chain of custody gives legal, forensic, and executive reviewers a defensible record of what was collected and whether it changed. Use the CISA Federal Government Cybersecurity Incident and Vulnerability Response Playbooks (2021) to structure containment, evidence preservation, recovery, and follow-up decisions in the exercise.

Set log-retention requirements before the tabletop ends. Keep enough identity, email, endpoint, cloud-storage, application, and network telemetry to cover the likely dwell time, discovery delay, investigation period, and legal hold.

Forward critical logs to a secured secondary system and restrict deletion rights. Without protected storage, retained logs remain exposed to routine cleanup.

Protect privacy while investigating. Limit access to investigators with a defined need, separate business-relevant evidence from personal content, and avoid broad mailbox searches when a narrower query can answer the question.

Establish whether communications, employee files, or third-party data are subject to legal privilege, employment protections, data-transfer restrictions, or breach-notification rules. Legal counsel should direct privilege decisions, while qualified forensic personnel define collection methods and explain what the evidence supports.

Counsel should advise on whether a given report is privileged, because copying counsel on a report does not by itself create privilege.

A tabletop exercise should end with explicit authorization gates. Participants should identify who can suspend an account, isolate an endpoint, notify a bank or partner, impose a legal hold, engage outside counsel, contact law enforcement, and declare a reportable breach.

They should also state which actions remain discussion-only until an incident-response retainer, privacy review, or forensic authorization is active. This distinction prevents well-intentioned responders from changing evidence or exceeding their authority.

The final investigation record should separate confirmed facts, working hypotheses, unresolved questions, and containment actions. Track whether credentials were used, mail or files were accessed, sensitive information was exposed, funds moved, and external parties were notified.

Continue monitoring for related logins, forwarding rules, OAuth activity, new accounts, and repeated indicators after recovery. Feed the findings into targeted phishing simulations so employees rehearse the verification and reporting behaviors that interrupt BEC attempts while the incident record remains factual, private, and reviewable.

What Should an Organization Do After Discovering Business Email Compromise?

After discovering BEC, treat the incident as an active fraud event that still has funds in motion. Contact the sending bank, payment network, law enforcement, insurer, and legal counsel immediately while preserving transaction and access records. The sending bank carries the recall to the receiving institution.

Recovery depends on response speed, whether funds remain in the receiving account, intermediary-bank cooperation, the payment rail, jurisdiction, and law-enforcement coordination. A business email compromise tabletop exercise should rehearse this sequence before it is needed.

Contact the Banks and Request a Recall

Stop additional movement of funds and trigger the banking process before investigating the full story. The treasury or finance lead should contact the sending bank through a verified telephone number and identify the transaction as fraud. They should then request a recall or reversal and ask the bank to initiate an urgent hold request with the receiving institution.

Provide the payment amount, currency, value date, beneficiary name, receiving account number, routing or SWIFT details, transaction reference, originating account, payment message, and exact time the fraud was discovered. Ask the sending bank to contact the receiving bank and any intermediary institutions involved in the payment chain.

For eligible wires, ask whether the bank requires a letter of indemnity or hold harmless letter from the organization to support the recall, and whether the receiving institution has acknowledged the request. For ACH, card, instant-payment, or other rails, ask for the applicable dispute, recall, reversal, or fraud-escalation procedure.

Payment networks impose different deadlines and standards, so a wire process does not apply to every payment type.

According to the FBI's September 2024 public service announcement, Business Email Compromise: The $55 Billion Scam, victims should contact their financial institution immediately and request a recall. That action creates a recovery opportunity, but it guarantees no outcome. Criminals can move funds through multiple accounts, convert them into other assets, or send them across borders before a bank places a hold.

Preserve evidence before deleting or altering anything. Export the original fraudulent email with full headers, payment instructions, approval messages, invoices or vendor-change requests, call records, chat messages, bank confirmations, authentication logs, and relevant mailbox audit data.

Record who discovered the fraud, when each person was notified, which bank employee accepted the escalation, every reference number, and each promised follow-up time. Assign one incident lead to maintain a timestamped action log so finance, security, counsel, and executives work from the same facts. A documented phishing incident response playbook keeps that sequence consistent across responders.

Coordinate Required Notifications and Cross-Border Decisions

Establish the reporting and communication perimeter without creating contradictory accounts. File a report with the appropriate law-enforcement agency, including the FBI's Internet Crime Complaint Center in the United States, and provide the bank with the report number.

File the report even when the bank has opened a fraud case. Law enforcement can coordinate with financial institutions and overseas authorities, while the report creates a formal record for recovery, insurance, and governance decisions.

Notify the cyber-insurance broker and carrier as soon as the policy requires, using the policy's breach or fraud hotline, since an informal email may fail the notice condition. Early notice protects the organization's ability to obtain approved forensic, legal, crisis-communications, and recovery services.

A payment-loss claim and a network-intrusion claim can follow different notice rules. Counsel and the broker should confirm the deductible, whether the insurer must approve costs before they are incurred, any fraud exclusions, social-engineering and funds-transfer-fraud coverage, and the proof of loss required.

Legal counsel should lead the assessment of regulatory, contractual, and privacy obligations. Reporting duties vary by sector, state, country, payment method, data exposure, and whether the event involved unauthorized account access or only fraudulent instructions.

A financial institution, health care provider, public company, government contractor, or educational institution each faces different timelines and regulators. Counsel should determine whether the organization must file a suspicious activity report, notify a regulator, issue a data-protection notice, provide contractual notice to a customer, or notify a vendor.

Avoid describing the event as a breach, fraud, or compromise in a public statement until the facts and legal position are established. Use a single approved incident description across the bank, insurer, law enforcement, board, and affected parties.

Cross-border cases require parallel coordination. Sequential handoffs waste the hours that determine recovery. Identify every country involved in the sender, beneficiary, intermediary bank, affected employee, customer, and service-provider relationships.

Confirm each jurisdiction's reporting route, language requirements, data-transfer restrictions, currency-conversion impact, and preservation rules. A receiving bank in another jurisdiction may require different documentation before freezing funds, and law-enforcement assistance can take longer across borders.

The incident lead should record each jurisdiction's owner, deadline, and status. That record prevents missed notices and gives counsel a defensible account of the organization's response.

Customer and vendor communication should protect trust while withholding intelligence the cyberattacker could use. If a supplier's mailbox or payment details were involved, contact the supplier through a previously verified channel and confirm whether other invoices, bank changes, or messages were fraudulent.

If customers could send money to the cyberattacker or receive malicious instructions, provide a concise warning through an authenticated channel. Employees should avoid replying to the fraudulent thread, approving related payments, or contacting the suspected account through details supplied in the message.

Monitor Recovery and Prove Containment

Recovery continues after the bank opens a case. Schedule updates with the sending bank, receiving bank, insurer, and law enforcement, then record the status of each recall, hold, or tracing request.

Ask whether funds remain in the destination account, whether an intermediary bank has acknowledged the request, whether the beneficiary account is frozen, and what additional evidence is required. If the bank cannot recover the payment, preserve the denial or closure record for insurance, accounting, legal, and board reporting.

Run a second-payment test before declaring the incident contained. Search for pending wires, scheduled ACH transactions, newly changed vendor banking details, duplicate invoices, and approvals connected to the same supplier or executive.

Review accounts-payable queues and payment portals for activity initiated before discovery and still unsettled. Confirm that no employee has received a follow-up request for another transfer, gift card purchase, credential reset, or confidential file.

Security teams should investigate continued malicious activity across the compromised mailbox, identity provider, and connected applications. Check for suspicious login attempts, unfamiliar devices, impossible-travel events, new mailbox rules, automatic forwarding, delegated access, newly registered multifactor authentication methods, OAuth grants, and password-reset activity.

Preserve logs before retention periods remove them. Remove unauthorized rules and sessions, reset credentials through a controlled process, revoke tokens, review privileged access, and monitor affected accounts for new impersonation attempts. Employees who suspect their own account can follow the steps for what to do if an email account is compromised.

Continue heightened monitoring for the period defined by the incident commander and counsel, with special attention to payment changes and executive communications. Use a known telephone number or independently verified channel for every high-risk request.

A clean inbox proves little about cyberattacker access. Cloud sessions, forwarding rules, stolen credentials, and third-party applications can preserve that access after a password change.

The board update should state the amount at risk, amount recovered or still exposed, payment rail, discovery time, recall time, jurisdictions, law-enforcement report status, insurance notification status, operational impact, and decision deadline. Distinguish confirmed facts from open questions and avoid promising that funds will be recovered.

After the immediate response, use the timeline to build a phishing response and phish triage workflow that tests reporting, escalation, and remediation. Measuring only whether an employee clicked misses the coordination the incident actually required.

A BEC tabletop exercise succeeds when the readiness score meets its targets, and that outcome depends on participants executing this recovery sequence under pressure. The exercise should test whether finance knows whom to call, security can identify continued access, legal can map reporting obligations, communications can warn affected parties, and executives can make decisions from a documented record.

Assign every identified gap to an owner with a deadline. Those corrective actions produce stronger payment controls, clearer escalation paths, and better preparation for the next fraudulent payment request.

How Should Organizations Tailor and Schedule a BEC Tabletop Exercise?

The exercise should match the organization's payment complexity, decision-making structure, and exposure to fraud. Small businesses and nonprofits need a short discussion focused on payment approvals and trusted contact paths. Multinational and regulated financial organizations need layered scenarios covering cross-border transfers, legal duties, and technical investigation.

The design should reflect organizational change, previous findings, current risk, and regulatory or insurance expectations.

How Should a BEC Exercise Differ by Organization Size?

A small business should include the owner or executive, finance lead, payment approver, IT contact, and employee most likely to receive vendor or payroll requests. The scenario can follow one suspicious invoice from an altered email through payment approval, callback verification, and bank notification.

The objective is to establish a secondary contact path and a clear stop-payment decision.

A nonprofit should add grant administrators, development staff, and board or executive leadership when donations, grants, or restricted funds create distinct fraud risks. The exercise should test a request that appears to come from a donor, board chair, or partner organization.

Limited staffing makes role substitution essential, so participants should identify who acts when the finance lead or executive is unavailable.

A multinational company needs regional finance, treasury, procurement, legal, communications, and business-unit leaders. Its exercise should include time-zone handoffs, local payment rules, language differences, foreign exchange, and vendors whose contact details vary across regions.

A cross-border payment scenario should also test whether a regional team can pause a transaction without waiting for headquarters.

A regulated financial organization needs compliance, fraud operations, risk, privacy, legal, customer-facing teams, and technical investigators. The scenario should examine suspicious transaction review, evidence preservation, customer notification, regulator communication, and insurance reporting.

Use phishing simulation capabilities for BEC and vendor-impersonation practice to connect discussion outcomes with employee behavior while keeping blame out of the room.

How Long Should a BEC Tabletop Exercise Run, and How Often?

An initial exercise should run for 90 minutes to two hours. That window supports a concise briefing, three or four decision points, an evidence review, and a documented after-action discussion. A smaller organization can finish in 90 minutes, while a multinational or regulated institution should reserve two hours when several approval layers are involved.

Longer sessions are justified when the scenario includes cross-border payments, multiple business units, technical investigation injects, compromised mailboxes, identity provider logs, or simultaneous vendor and executive impersonation.

Avoid adding complexity simply to fill time. Each inject should test a decision, expose a dependency, or validate a contact path.

Cadence should follow change and risk. Run an exercise after a merger, banking change, payment platform migration, major executive turnover, new vendor onboarding, restructuring, or material incident.

Repeat sooner when a prior exercise reveals unclear authority, outdated contacts, or slow bank escalation. Regulatory commitments, cyber insurance requirements, and board expectations can set the minimum schedule, though risk-based judgment should still drive the calendar.

What Preparation Logistics Make the Exercise Realistic?

Preparation starts with a written objective, participant list, scenario timeline, injects, decision log, and evaluation criteria. The CISA packages offer adaptable planning templates that can be modified for a BEC scenario.

Keep the session focused on decisions and dependencies. Attempting to test every business process at once produces a long meeting and a thin action register.

Use fictional or sanitized details only. Replace employee names, account numbers, and customer data with controlled stand-ins, and preserve the organization's approval thresholds, payment workflow, vendor relationship, email conventions, and escalation contacts.

Confirm that every phone number, distribution list, bank instruction, and emergency channel works before the session. Facilitators should also validate every operational assumption against current banking procedures, internal policy, and authoritative guidance before using the scenario.

Send participants a brief pre-brief explaining the purpose, scope, duration, and discussion rules. State that the exercise evaluates processes, and make the nonpunitive standard explicit. Establish confidentiality, prohibit recording unless approved, separate exercise data from production systems, and explain how findings will be stored.

An external facilitator can protect candor, manage seniority dynamics, and challenge assumptions when finance or executive leaders own the process under review.

Close with named owners and deadlines for every gap. Repeat the exercise after material remediation, and change the scenario so the team faces a new test.

That cycle turns a one-time discussion into an operating control that keeps payment decisions, contact paths, and human judgment aligned as the organization changes.

How Should Organizations Measure Success in a BEC Tabletop Exercise?

A BEC tabletop exercise should compare operational readiness with administrative completion. Completion measures whether people attended, while readiness measures whether they recognized fraud, verified the request, escalated quickly, and completed recovery actions under pressure.

Attendance creates a participation record. A scored exercise produces evidence about decision quality and response speed. A readiness rubric shows whether the organization can contain a fraudulent payment request before funds move or access spreads.

Both measures have value, and readiness should determine the corrective action plan and the design of future exercises.

What Objectives Should a BEC Tabletop Exercise Measure?

A useful exercise begins with measurable objectives tied to the full response chain, because a general goal such as "test awareness" produces no scorecard. The CISA packages also include feedback forms and After Action Report templates that can be adapted to a BEC scenario.

Use the following objectives as the exercise scorecard:

• Detection: Measure the time from the first suspicious email, invoice change, or executive request to the moment a participant identifies likely fraud.
• Verification: Measure the time required to confirm the payment request through a trusted, out-of-band channel that was not supplied in the suspicious message.
• Escalation: Measure the time from recognition to notification of the designated security, finance, legal, or incident-response lead.
• Bank contact: Measure the time from confirmation of likely fraud to contact with the bank, payment processor, or treasury partner.
• Account security: Measure the time required to disable, lock, or secure a compromised mailbox, identity, vendor account, or payment approval path.
• Participation: Record the percentage of required participants reached, including finance, accounts payable, IT, security, legal, communications, executive leadership, and the relevant bank contact.
• Inject handling: Record the percentage of scenario injects handled correctly, such as a second invoice, a fake callback number, a request to bypass dual approval, or evidence of mailbox access.
• Evidence preservation: Evaluate whether participants retained the original message, full headers, attachments, URLs, call details, payment records, chat messages, timestamps, and relevant identity logs without altering them.
• Recovery: Record the percentage of required recovery actions completed, including payment recall, credential resets, session revocation, mailbox review, vendor notification, and control restoration.
• Governance: Confirm whether decision rights, approval thresholds, alternate contacts, legal obligations, executive communications, and documentation ownership were clear.

Set a target before the exercise begins. For example, a finance-led scenario could require likely fraud recognition within 10 minutes of the first message, out-of-band verification within 15 minutes of recognition, escalation within 20 minutes of recognition, and bank contact within 30 minutes of confirmed likely fraud. These targets are illustrative.

These thresholds are organization-specific, and facilitators must document them in advance. Introducing expectations after the exercise starts leads to an argument that buries the finding.

What Scoring Criteria Should a BEC Tabletop Exercise Use?

A 0-to-4 model creates more useful evidence than a pass-or-fail result, because it separates a missing capability from a delayed or incomplete one. Score each objective independently, then calculate a domain average and an overall readiness score.

Treat any critical failure as a red condition even when the average score appears acceptable. A critical failure is a critical domain scored 0 or 1, such as an inability to contact the bank or preserve evidence.

Apply the model to each domain, because one subjective grade for the whole exercise hides the domain that failed. A detection score of 3 means the team recognized likely fraud but took longer than the target.

A verification score of 1 means participants discussed calling the executive but used the phone number included in the suspicious email, which fails the independent-verification standard. An evidence-preservation score of 0 means the message was deleted or forwarded without its headers, even if the payment was stopped.

For quantitative reporting, calculate the percentage of objectives scored at 3 or 4, the average score across all domains, and the number of critical domains scored at 0 or 1.

Designate the critical domains before scoring. Detection, verification, escalation, bank contact, account security, and evidence preservation are the usual set.

A practical traffic-light interpretation applies three bands. Green requires an average of 3.0 or higher with every critical domain at 3 or above. Amber covers any result that does not meet green, with an average of 2.0 or higher and every critical domain at 2 or above. Red covers an average below 2.0, or any critical domain scored 0 or 1.

Keep the underlying evidence beside the color so leaders can see whether amber reflects slow bank contact, incomplete alternate-contact coverage, or weak evidence handling.

How Should Teams Compare Results Across Exercises?

Repeat-exercise validation builds a measurement program from a single tabletop. Use the same core objectives, definitions, time starts, and time stops in every round, then vary the scenario details and inject order.

A first exercise might involve a changed vendor bank account. A later exercise introduces a compromised executive mailbox, an urgent voice call, or a payment request arriving during a holiday period.

Report each round in the same format. For every metric, record the baseline result, the latest result, the absolute change, and the percentage change.

For example, if bank contact falls from 42 minutes to 24 minutes, report an 18-minute improvement and a 43% reduction, and identify which procedural change produced them. If out-of-band verification adherence rises from 60% to 90% of eligible requests, preserve the updated callback process and test whether employees use it under a different scenario.

Improvement indicators should include faster bank contact, fewer approval exceptions, higher out-of-band verification adherence, complete alternate-contact coverage, and reduced time to revoke access.

Also track faster recognition of likely fraud, shorter escalation time, higher inject-handling accuracy, stronger evidence preservation, and a greater percentage of recovery actions completed before the exercise ends.

A faster response that relies on more approval exceptions is a regression. Speed must be paired with correct control execution.

Separate capability improvement from participant familiarity. If the same team receives the same scenario, higher scores can reflect memorization. Change the sender identity, payment amount, communication channel, business context, and timing while keeping the scoring rules stable.

Include new participants or alternates in later rounds to test whether the process works beyond the people who attended the first exercise. Comparable measurement across rounds also feeds human risk scoring at the department level.

Maintain an action register after every round. Each action should name an owner, due date, affected procedure, verification method, and status. The next exercise should test unresolved actions directly.

If the previous round exposed missing bank contacts, a later inject should require participants to locate and use the alternate bank escalation path. If evidence handling failed, a later round should include a mailbox artifact that must be preserved before remediation.

Why Is Completion Alone Not a Readiness Metric?

Completion shows that a person attended a session. Whether the organization can stop a fraudulent payment remains untested.

A fully attended exercise can still reveal that finance lacks an alternate bank contact, security cannot revoke an executive session quickly, legal does not know who owns notification decisions, or communications cannot distinguish confirmed fraud from an unverified allegation.

Treat completion as a participation metric. Outcome measurement requires timed, scored evidence. Report required participants reached separately from injects handled correctly, recovery actions completed, and critical decisions made within the target time.

As an illustration, a team that reaches 100% of required participants but correctly handles only 50% of injects is not ready. A team that reaches 90% of participants and scores 4 across detection, verification, escalation, and account security may have stronger operating capability, though the missing participants still require follow-up.

The final exercise report should show the score by domain, the evidence supporting each score, unresolved actions, and the comparison with the prior round.

That record gives executives a defensible view of readiness and gives response teams a practical agenda for improving controls. A scorecard becomes operationally useful when every measure is tied to an inject that forces a decision, exposes a control gap, or tests recovery under pressure.

What Should Happen After a BEC Tabletop Exercise?

After a business email compromise tabletop exercise, document observations, assign corrective actions, update procedures, and schedule a retest. BEC exercises should expose weaknesses in the incident-response plan and BEC playbook, with every material change validated through evidence and a later exercise.

Treat unresolved questions as tracked risk. Filing them as acceptable uncertainty makes it likely they resurface during an actual incident.

1. Produce an After-Action Report That Records Decisions

The after-action report should show how the exercise unfolded and where the organization lost time, information, or authority. Record major decisions, including who approved a payment hold, who authorized account containment, when legal counsel was engaged, and why the team selected one communication channel over another.

Capture unresolved questions, role confusion, missed notifications, payment-control weaknesses, employee training gaps, technology gaps, contact-list failures, evidence-handling issues, and communication breakdowns.

Write findings as operational failures with measurable consequences. A vague observation such as "finance needs more awareness" gives leadership nothing to fund.

A usable finding reads like this: "Accounts payable lacked an independently verified bank contact. The team could not confirm whether the vendor account change was legitimate within 30 minutes." That wording gives leadership a control to assign, test, and fund.

The CISA Federal Government Cybersecurity Incident and Vulnerability Response Playbooks (2021) recommend a lessons-learned analysis to assess incident-handling effectiveness and capture problems, root causes, and improvements.

Use the report as the authoritative record, while keeping sensitive investigative details, employee information, and legal advice in the appropriate restricted repository.

2. Convert Each Finding Into a Controlled Action

Every corrective action needs one accountable owner, a priority, a due date, an evidence requirement, and a residual-risk statement. Assigning a department creates ambiguity about who acts. Assigning an owner without evidence produces a status update that cannot be verified.

High-priority actions should address controls that could authorize an improper payment, delay containment, or prevent required notification.

A useful action record states the finding, business impact, owner, priority, due date, dependency, required evidence, status, and residual risk.

Evidence might include an approved incident-response plan, a revised vendor-payment procedure, a completed contact verification, a system configuration export, a training completion report, or exercise minutes showing that the change worked. The residual-risk statement should explain what remains exposed, why leadership accepts it, and when the risk will be reassessed.

Map each BEC finding to the relevant area in the CIS Controls v8.1, including security awareness and skills training, incident-response management, service-provider management, audit logging, and email protections.

This mapping shows whether the exercise exposed a people, process, technology, or governance weakness, so the budget follows the actual gap.

3. Update Plans, Procedures, and Contact Paths

Update the incident-response plan with BEC-specific triggers, decision rights, evidence-preservation steps, payment-freeze authority, and notification timelines.

The BEC playbook should define what happens in four situations: an employee reports a suspicious message, an executive identity is impersonated, a vendor requests new payment instructions, or a payment has already been sent. Include instructions for preserving the original email, headers, attachments, chat messages, call records, invoices, approval history, and bank-transfer details without altering the evidence.

Revise vendor-payment procedures around independent verification, trusted callback numbers, dual approval, and segregation of duties. A second approver should never confirm by replying to the originating thread.

Require confirmation through a previously verified contact method, and document exceptions when urgent payments bypass the normal process.

Refresh the escalation matrix so finance, treasury, security, legal, communications, executive leadership, and business owners know when to act. Verify bank contacts, cyber insurer details, law-enforcement contacts, and regulator contacts, because a responder working from an old document reaches voicemail at the worst moment.

Add alternate communication channels, such as phone trees, secure messaging, or preapproved out-of-band collaboration spaces, for situations in which corporate email is untrusted. Authentication controls deserve the same review, including the organization's progress toward phishing-resistant MFA.

4. Close the Human and Technology Gaps

Training updates should reflect the exact behaviors observed during the exercise. If participants trusted a familiar display name, create practice scenarios around sender identity and thread hijacking. If employees hesitated to report a suspicious request, clarify the reporting path and rehearse it.

If finance staff lacked confidence challenging an executive, train them to pause a payment without fear of blame and escalate through the approved channel. Role-based cybersecurity awareness training keeps that practice aligned with each team's actual exposure.

Technology actions should address missing signals and slow response. Confirm that email reporting routes reach the right responders, logs are retained long enough to investigate, mailbox searches can identify related messages, and payment systems preserve approval records.

Where the exercise exposed a need for faster reported-message classification or remediation, connect the workflow to phish triage capabilities while keeping the required human approval for financial decisions in place.

5. Retest Every Material Finding and Report Progress

A later exercise should retest every material finding, including actions marked complete. Test whether the revised playbook identifies the right owner, dual approval stops an unauthorized payment, bank and insurer contacts answer, employees use the reporting route, and responders preserve evidence correctly.

Close an action only when the retest produces the required evidence.

Executives and the board need progress reporting that shows risk movement, since a simple percentage of completed tasks hides which control still fails. Report open high-priority findings, overdue actions, accepted residual risk, control owners, retest results, and decisions requiring funding.

A closed document says little about readiness. Repeated performance under a new scenario does, especially when the organization can show which controls held under pressure.

How BEC Tabletop Exercises Strengthen the Human Layer of Security

A business email compromise tabletop exercise exposes how quickly a plausible request can move from an employee's inbox to a financial, identity, or vendor-trust decision. The CISA packages use scenarios such as phishing and insider threats to test information sharing, incident response, and recovery.

The immediate value is a prioritized improvement plan with clearer verification steps, role-specific training, and faster reporting, delivered before a fraudulent request arrives and moves money.

How Do BEC Exercises Reveal Behavior Under Pressure?

A BEC exercise tests decisions when urgency, authority, and incomplete information collide. A finance employee may receive an AI-generated phishing email that appears to come from a senior executive, while a procurement employee receives a follow-up vishing call from someone claiming to be a trusted vendor.

The exercise reveals whether people pause, verify the request through an approved channel, and report suspicious activity, or whether familiar names and deadlines override those safeguards.

The outcome should never be a list of employees who "failed." It should map the conditions that make safe action difficult. If participants do not know who can approve an urgent wire, the control gap belongs to the process.

If they recognize warning signs but lack a simple reporting route, the organization has a workflow problem. If executives publish enough audio, video, and organizational detail to support convincing impersonation, the exposure includes executive identity and OSINT alongside employee awareness.

Those findings should shape targeted cybersecurity awareness training. Finance teams benefit from practice with invoice fraud and vendor impersonation, executives and assistants from deepfake and voice-cloning scenarios, and customer-facing teams from vishing and smishing scenarios.

All employees need reinforcement on spear phishing, AI-generated phishing emails, multifactor authentication prompts, and safe reporting. Multi-channel phishing simulations provide repeatable practice for those lessons while keeping blame away from the person who made the wrong decision during a controlled exercise.

Why Must BEC Verification Cross Multiple Channels?

BEC risk sits at the intersection of employee judgment, finance controls, executive identity, vendor trust, and technical account security. A tabletop exercise should test more than whether an email looked suspicious.

It should determine whether the recipient confirms a payment change using a known phone number, whether finance requires dual approval, whether IT can protect a compromised account, and whether leaders understand how public information supports impersonation.

A second channel earns trust only when it was established in advance. A cyberattacker can coordinate email, voice, SMS, and video, so a convincing message followed by a familiar voice or deepfake video creates a false sense of independent confirmation. Documented deepfake voice fraud cases show how convincing a familiar voice can be.

The exercise should require participants to identify which channels are trusted, which are merely familiar, and who owns the final decision when the channels disagree.

Controls should make safe decisions easier. Require out-of-band confirmation for payment changes, prohibit approval based only on a reply thread, and define escalation paths for suspicious executive requests. Give employees a visible reporting route that reaches security and finance quickly.

A nonpunitive reporting culture creates an early-warning network among employees, because people report more readily when raising an alert avoids embarrassment and automatic discipline.

How Can Teams Convert Exercise Findings Into Continuous Improvement?

A tabletop exercise creates value only when its findings change the next training cycle. Record decision points, delays, unclear ownership, and control failures, then translate each finding into a measurable action.

A recurring program can connect targeted simulations, short microlearning, risk measurement, and board reporting while protecting individual privacy.

• Targeted practice: Assign finance, executive support, procurement, and IT scenarios based on role exposure, so employees rehearse the response to the cyberattacks they actually receive.
• Just-in-time learning: Deliver brief lessons after a participant misses a verification step, mishandles a multifactor prompt, or fails to report a suspicious message.
• Risk measurement: Track reporting speed, verification completion, repeat errors, and department-level improvement without publishing names or ranking employees for punishment.
• Board reporting: Present unresolved control gaps, time to escalation, and progress against defined targets in business terms.
• Recurring validation: Retest the process after policy changes, executive turnover, vendor changes, or new cyberattack methods that use AI.

This cycle connects tabletop discussion with broader human risk management. The organization measures whether people can apply the right behavior under pressure, which is a far stronger signal than completing an annual course.

That distinction keeps training practical and preserves employee trust.

How Can Teams Turn a Business Email Compromise Exercise Into a Reusable BEC Response Playbook?

An exercise becomes reusable when leaders convert discussion points into assigned actions, decision thresholds, and evidence that teams can follow under pressure. Build the playbook by defining objectives, preparing role-specific materials, running timed injects, recording decisions, and tracking corrective actions to closure.

Treat every assumption made during the exercise as untested until someone verifies it against an actual procedure.

1. Prepare the Pre-Exercise Checklist

Start with a fixed planning packet that makes the exercise repeatable across departments, business units, and jurisdictions. Define objectives such as verifying payment controls, testing executive escalation, measuring bank-recall readiness, and confirming evidence-preservation steps.

Add the participant list with primary and backup contacts for finance, treasury, accounts payable, security, IT, legal, compliance, communications, executive leadership, insurance, and the relevant banking relationship.

Prepare role cards that state each participant's authority, responsibilities, information available at the start, and the decisions that person cannot make alone. The scenario brief should describe the target, suspected impersonation method, payment request, known timeline, and operating assumptions while withholding the planned injects.

Create an inject timeline with precise release times for the initial email, a follow-up call, a changed bank account, an executive escalation, a suspected mailbox compromise, and a bank-confirmation update.

The packet should also include a decision log, communications tree, payment-verification checklist, evidence-preservation checklist, bank-recall checklist, and scoring rubric.

Add an after-action template and corrective-action tracker before the session begins, so the team records improvements as they surface. Reconstructing them from memory afterward loses the detail that made them useful.

2. Give the Facilitator a Timed Run Sheet

The facilitator run sheet should control the pace without telling participants what decision to make. Open by stating the exercise scope, confidentiality rules, discussion assumptions, and success measures.

Confirm that no real payments, account changes, employee monitoring, or external notifications will occur unless the exercise explicitly moves into a controlled validation activity.

Release the scenario in short stages. After each inject, ask four questions. What is known? What requires verification? Who has authority to act? What must be preserved or communicated?

Record each answer in the decision log alongside the classification, adding the owner, deadline, evidence requested, and unresolved dependency.

Challenge unsupported assumptions, especially statements such as "the CFO approved it," "the bank can reverse it," or "IT can recover the mailbox," until the relevant procedure is identified.

The same discipline should guide phishing simulations, where realistic scenarios test whether employees follow verification procedures under pressure. Recognizing a suspicious message is only the first step.

Score observable behavior, since confidence and presentation quality tell the evaluator little about readiness. The rubric should measure time to recognize suspected BEC, use of an independent payment-verification channel, escalation speed, and separation of duties.

It should also measure communications-tree accuracy, preservation of headers and messages, bank-recall execution, legal and regulatory judgment, and clarity of executive updates.

Keep discussion assumptions visibly separate from real-world procedures. A statement accepted for the exercise, such as "the bank will hold the transfer," must become a validation task before it enters the final playbook.

3. Convert Findings Into an Action Register

Close the session by transferring every gap into the corrective-action tracker. Each item needs a plain-language description, business impact, accountable owner, supporting team, priority, due date, dependency, evidence of completion, and review date.

Separate urgent control failures, such as missing callback verification, from documentation improvements, such as an outdated contact tree.

The final playbook should contain the approved payment-verification checklist, evidence-preservation checklist, and bank-recall checklist in the order employees will use them.

It should identify which channel is trusted for executive confirmation and who can freeze or recall a payment. It should also record which documents legal must preserve, how treasury contacts the bank, and when insurance, regulators, law enforcement, or affected partners must be notified.

Escalation guidance must reflect the organization's jurisdiction, payment location, data involved, and contractual duties, since a generic global procedure fails the first time a regional deadline applies.

Assign a document owner for each section and set review dates tied to material changes, including banking-provider updates, reorganizations, new payment workflows, executive turnover, and relevant incidents. Store the playbook where responders can reach it during an account compromise, while restricting edit access to prevent uncontrolled changes.

A static document becomes unreliable quickly. A named owner, defined evidence, and scheduled review keep it dependable when payment pressure is highest.

4. Validate the Playbook in a Later Session

Schedule another exercise before closing the current one. Select a different but realistic scenario and brief participants on their roles while withholding the inject sequence. Run the timed injects, measure the same rubric, and compare results against the original decision log.

A smooth discussion is only the starting point. The evidence that matters is whether owners closed gaps and whether employees can execute the procedure when urgency, authority, and incomplete information collide.

Use a repeatable cycle. Schedule the exercise, select a credible BEC scenario, and prepare the participants and materials. Then brief each role, release the injects, and record decisions. Finally, score the response, assign corrective actions, and validate the changes in a later session.

That cycle produces a living response playbook that finance and security teams can use when a suspicious payment request becomes an actual incident. Teams formalizing the wider program can pair it with a security awareness training policy template.

Business Email Compromise Tabletop Exercise FAQs

What Is the Ideal Length for a Business Email Compromise Tabletop Exercise?

A business email compromise tabletop exercise should run for 90 minutes to two hours, including the briefing and the after-action review. That window supports a realistic payment-fraud scenario, several escalation injects, participant decisions, and measurable discussion without exhausting the team.

Add time when the exercise includes multiple countries, currencies, business units, technical investigation, or external partners. Keep the scenario focused on decisions, since presentations consume the minutes the decisions need.

A shorter follow-up session can retest unresolved weaknesses and confirm that payment controls changed.

How Often Should an Organization Run a Business Email Compromise Tabletop Exercise?

An organization should run a business email compromise tabletop exercise at least annually and repeat it after material changes or significant findings. A new banking workflow, finance leader, payment system, acquisition, major vendor, jurisdiction, communication channel, or prior incident changes the decisions participants must make.

High-risk organizations should schedule focused exercises more frequently around payment approval and executive impersonation.

Set the cadence from risk and change, assign owners to findings, and retest every material gap before it becomes a familiar failure.

What Percentage of Funds Can Be Recovered After a Fraudulent BEC Payment?

No reliable universal percentage exists for funds recovered after a fraudulent business email compromise payment. Recovery depends on how quickly the organization contacts its bank and law enforcement, whether the funds remain available, the payment rail, intermediary banks, jurisdiction, and cooperation from the receiving institution.

According to the FBI IC3 Internet Crime Report 2025, the FBI's Recovery Asset Team froze $679,013,183 of $1,163,919,846 in attempted theft across 3,900 Financial Fraud Kill Chain incidents. That process covers only qualifying reports and describes an aggregate outcome, and no individual victim or payment carries a guarantee.

Treat every minute as consequential. Preserve the transaction record, request a recall or hold immediately, report the incident to the FBI's Internet Crime Complaint Center, and document every contact.

Should a CEO or CFO Participate in a Business Email Compromise Tabletop Exercise?

A CEO or CFO should participate when the exercise tests executive impersonation, payment authority, crisis communication, or unavailable decision-makers. Their presence reveals whether finance and security teams can verify urgent requests without relying on title, pressure, or a familiar writing style.

Include an alternate executive when operational availability is limited, and use an inject that removes the primary approver. The facilitator should test the real escalation path while keeping live credentials, private messages, and sensitive payment data out of the room.

Executive participation shows whether authority holds up as a tested control.

What Evidence Should Be Preserved During a Business Email Compromise Investigation?

A business email compromise investigation should preserve the original messages and headers, payment records, wire instructions, bank communications, authentication logs, mailbox audit logs, forwarding rules, inbox rules, sign-in locations, device details, connected applications, and relevant endpoint data.

Record timestamps, custodians, collection methods, file hashes where applicable, and every containment or recovery action. Preserve evidence before deleting messages, resetting devices, or changing configurations, and let qualified forensic personnel direct the collection order under legal counsel's instruction.

The FBI business email compromise guidance stresses prompt reporting and protective account controls. Coordinate collection with legal, privacy, and forensic specialists so containment preserves the facts needed for recovery and notification decisions.

Reduce Phishing Risk Across the Human Layer

Business email compromise exploits trusted decisions under pressure, especially around payment requests and executive identity. Adaptive Security gives security and finance leaders measurable practice across phishing, SMS, voice, and deepfake scenarios.

Take a self-guided tour of Adaptive Security's phishing simulation capabilities.