Business Email Compromise Training: What Employees Need to Know

Teach five things and most business email compromise attempts fail before they cost anything: the variants your staff will actually see, the red flags that survive a carefully written forgery, one fixed routine for verifying any change to payment details, a reporting path people will use within minutes, and a record showing you trained them. Business email compromise is not a technical exploit. There is no malware to detect, no password to steal, no vulnerability to patch. It is a convincing conversation that persuades someone with legitimate access to move money or data on their own. That is why training, more than tooling, decides whether it works.

What business email compromise actually is

Business email compromise, usually shortened to BEC, is fraud carried out through email that appears to come from someone the recipient already trusts. The attacker rarely breaks in through a clever exploit. More often they buy credentials that leaked elsewhere, guess a weak password, or simply register a lookalike domain one character off from the real one. Then they write to a person who has both the authority and the habit of acting on email quickly.

The distinguishing feature is that nothing on the recipient's screen looks broken. The message arrives from a plausible address, uses the right names and job titles, references a real invoice or a real project, and asks for something unremarkable. Payment instructions change. A vendor asks you to use a new account. A director needs gift cards for a client meeting. Payroll needs updated direct deposit details. Each request is small, normal and urgent enough that questioning it feels rude.

Because the fraud runs on trust rather than technology, endpoint protection, spam filtering and multi-factor authentication all help at the edges but cannot close the gap. The decision to pay, to forward a file, or to update bank details happens inside a person's head, and that is the layer training addresses.

Why BEC targets people instead of systems

Attacks on systems require finding a flaw and exploiting it before it is fixed. Attacks on people require finding a moment when someone is busy, new, covering for a colleague, or under pressure to keep a client happy. That moment is available in every organization, every week, and it does not need to be discovered by scanning anything.

There is a second reason the human route is attractive: the person being deceived has legitimate access to everything the attacker wants. No privileges need to be escalated. When a finance manager updates a vendor's bank account because the email looked right, the transaction is authorized, correctly formatted, and approved by the right person. Every control that checks whether the payment is allowed will pass. Only the destination is wrong.

This is also why BEC rarely announces itself. A ransomware attack makes noise immediately. A payment diversion may not surface until a real vendor asks why an invoice is unpaid, weeks later, after the money has been moved through accounts that are hard to freeze. The damage is quiet, and quiet fraud is the kind that benefits most from people who know what to look for.

The variants that actually show up in small and mid-sized organizations

Large, well-known attack categories get written about constantly, but the messages that reach a 30-person firm tend to fall into a smaller set of patterns. Teaching these five covers most of what your staff will genuinely encounter.

Vendor invoice fraud

A supplier you already pay sends an updated remittance notice, or a message arrives that appears to be from them, explaining that their bank has changed and future payments should go to a new account. Everything else about the email is right: the invoice number matches an open order, the amount is in the expected range, the tone matches previous correspondence. The only false element is the account number.

This is the variant most likely to be paid without anyone noticing, because paying invoices is routine work. The tell is not in the email at all. The tell is that the change arrived by email rather than through the channel you normally use to confirm banking details.

Executive impersonation

An email from the owner, the CFO or a partner asks for something urgent and slightly irregular: a wire before a deadline, a copy of payroll data, a quick payment to a new consultant, or simply a reply confirming that a payment is ready. It often arrives when the real person is known to be travelling or in meetings, and it is usually short, because executives are imagined to be brief.

The request is designed to make asking questions feel like insubordination. That is the mechanism. Authority does the work that malware would otherwise have to do.

Payroll diversion

A message that looks like it comes from an employee asks HR or payroll to update their direct deposit details before the next pay run. It usually includes a plausible reason, such as a new bank or a closed account. If it succeeds, that employee's salary goes to the attacker, and the employee discovers it only when the deposit does not appear.

Payroll diversion is unusual in that it is often attempted from within a compromised mailbox rather than from a lookalike address. The message genuinely comes from the employee's own account, which is why the only reliable defense is verifying the change through a channel other than the one it arrived on.

Thread hijacking

An attacker who gains access to a mailbox reads an existing conversation, then replies inside it. Suddenly a real discussion about a real invoice continues, except the next message introduces new payment details, or an attachment that asks for a login. Because the thread is real, the recipient's guard is already down. This variant is especially effective in construction, real estate, title and escrow, and professional services, where money and documents move by email between parties who may never meet.

W-2 and payment-change requests

Two closely related requests appear constantly during tax season and at year end. The first asks HR or finance to send employee W-2 forms or payroll summaries, usually framed as needed for a filing deadline. The second asks for a supplier's or customer's bank details to be updated in your system, so that future payments go to the wrong place without any single fraudulent invoice ever being sent.

Both exploit a records task rather than a payment task, which is why they sometimes slip past defenses tuned to watch money movement. A file of W-2s is among the most valuable things an attacker can obtain from a small business, because it hands them the identities of everyone you employ.

The red flags employees can actually learn

Long red flag lists read well and get forgotten by Tuesday. What survives is a short set of signals people can recognize while reading on a phone. Teach these and repeat them.

• A change of banking details, sent by email. Treat this as suspicious by default regardless of how correct everything else looks. It is the single highest-value signal in BEC, and it is worth overriding every other judgement.
• Urgency combined with secrecy or an unusual channel. Deadlines, "do this before I land", "don't discuss with the team yet", or a request to move the conversation to a personal address or a text message.
• Small mismatches in the sender. A reply-to address that differs from the visible one, a domain that ends in a different spelling, an extra word before the domain name, or a display name that matches a colleague while the address does not.
• Requests that skip the normal process. A payment that would bypass approval, an invoice with no purchase order where one is always required, or a request to send documents outside the usual shared system.
• A reply inside an existing thread that changes the terms. If the account number, the recipient, or the scope of a conversation shifts mid-thread, verify it, even if the thread otherwise reads perfectly.
• Attachments and links that ask for a login. A document that leads to a sign-in page, or a link whose address does not match the organization it claims to be.
• Pressure to be helpful. A newcomer, a junior employee, or anyone covering for an absent colleague is a preferred target, because being unhelpful feels worse than being cautious.

Notice what is not on that list: spelling mistakes and awkward grammar. Modern fraudulent email is often clean, sometimes better written than internal mail. Teaching staff to hunt for typos trains them to miss the well-made attempt, which is the one that will actually arrive.

A verification routine that stops most attempts

Training that ends with "be careful" changes nothing. What changes outcomes is a routine so specific that following it requires no judgement call. The version below is deliberately short enough to fit on a card by the phone.

Step one: stop the action, not the conversation

Nobody needs to accuse anyone. The script is simply: "I want to get this right, so I'm going to confirm it before it goes through." This works with a furious client, an impatient partner, and a supplier chasing payment. It reframes verification as diligence rather than distrust, which makes people far more willing to do it.

Step two: verify out of band, using a known number

Out of band means a different channel from the one that made the request. If the request came by email, pick up the phone. The number must come from your own records, a signed contract, the vendor's own website typed in directly, or a directory you maintain, never from the email or the signature block. Calling the number in a fraudulent email reaches the fraudster, who will happily confirm everything.

For a supplier, this is usually one call to an accounts contact you already have. For an executive request, it is a message or call to the person directly on a number you already know.

Step three: apply two-person review to any change of payment details

Every change to bank details, direct deposit, or remittance instructions should require a second person to confirm it independently. Not a forward, not a cc, but a separate verification by someone who is not the original recipient. In a small firm, that might be the owner and the bookkeeper. In any firm, it should be written down, because a rule that lives only in habit disappears during a busy week.

This is the clearest example of a case where a policy control does more than training. Training makes people suspicious; a two-person rule makes the fraud structurally impossible to complete quietly, even when someone is having a distracted day.

Step four: confirm the money has not already moved

If a payment was released before verification, say so immediately rather than trying to fix it quietly. Speed is what makes recall possible, and banks can act only while the funds are still traceable. Hiding a mistake to avoid embarrassment is the most expensive instinct in this entire scenario, and it is worth naming directly in training, because it is the reason many losses grow.

How to report, and why speed matters more than process

A report that arrives in ten minutes is worth far more than the same report that arrives tomorrow morning. Within those minutes, a mailbox password can be reset, a payment can be recalled, a message can be pulled from other inboxes, and colleagues who received the same email can be warned. After a day, the money has usually moved through at least one account and recovery becomes a legal process rather than an operational one.

Make reporting trivially easy and completely blameless. Name one channel, whether that is a shared inbox, a ticket, or a direct message to a named person, and repeat it in every training cycle. Say plainly that reporting a suspected fraud that turns out to be genuine is a success, not an error. Then behave that way the first time it happens, because the first response is what teaches people whether reporting is actually safe.

Give people a short list of what to include so the report is actionable: what was requested, who it appeared to come from, the exact time, whether anything was clicked or replied to, and whether any payment or data was released. Ask them not to delete the message and not to forward it widely, since forwarding spreads any malicious link to more inboxes.

What to teach, and what a policy should handle instead

Not every BEC failure is a training failure, and pretending otherwise leads to programs that keep adding slides while the underlying gap stays open. Some gaps are structural and close only with a control.

• Teach: recognizing the five variants, spotting the signals above, running the four-step verification, and reporting quickly and without fear.
• Control: mandatory two-person approval for any change of payment details, callback verification recorded in the vendor file, a rule that payroll changes require in-person or verified contact, and a technical block on auto-forwarding to external addresses.
• Control: email authentication configured on your own domain, so that messages claiming to be from you are far less likely to reach anyone at all.
• Teach: what to do when the request appears to come from your own leadership, since that is where authority pressure is strongest and where staff most need explicit permission to verify.

The honest framing for leadership is this. Training reduces the number of times someone is fooled. Controls reduce the cost when someone is. A program with only one of the two is incomplete, and the control side is usually cheaper to fix.

Common mistakes in BEC programs

Most failed programs fail in the same handful of ways, and all of them are avoidable.

Teaching awareness without teaching a sequence

Employees leave knowing that BEC exists and that they should be careful, which is not a behavior. Nothing in the session tells them what to do in the ninety seconds after a suspicious email arrives. Replace general warnings with the specific routine, ideally practiced once on a real example from your own inbox, sanitized.

Making the test the lesson

A simulated fraudulent email that punishes whoever falls for it teaches people to fear being caught rather than to report. Since reporting is the outcome that actually protects the business, punitive simulations work against the goal. If you run simulations, frame them as measurement, give immediate explanatory feedback, and treat a report of a simulated attempt as the best possible result.

Assuming finance is the only audience

Finance handles money, but HR holds W-2s and payroll details, reception controls who gets put through to whom, and account managers hold the client relationships that make thread hijacking work. Everybody who can authorize, forward, or influence a transaction needs the training, including the owner.

Skipping the awkward case

Many programs carefully explain vendor fraud and never address the request that comes from the boss. Staff are left to infer that verifying a senior person is insubordinate. Say it out loud in training: leadership requests get verified too, and leadership has agreed to it. A one-line statement from the owner is worth more than a slide.

Buying content nobody finishes

Before choosing training, look at the length and shape of the actual modules, not the topic list. If the BEC material is a fifty-minute video with no scenario practice, completion rates will be high on paper and low in effect. Short modules with a decision to make at the end hold attention and produce recall. Ask whether the course reflects current variants, including thread hijacking and payroll diversion, or still describes only the generic "Nigerian prince" email. Ask whether it addresses AI-assisted messages that carry no typos at all. Ask what the administrator can see afterwards, because a program you cannot evidence is a program that will not satisfy an auditor or an insurer.

Documenting the training so it holds up later

The question that arrives after an incident, or at renewal, is rarely "did you train people". It is "show me". What satisfies that request is a record of who completed which course, on what date, covering which topics, with a certificate that can be independently verified.

Build the record as a byproduct of running the program rather than a project in itself. Enroll everyone, assign the course, let the platform track completion, and keep the completion report somewhere you can retrieve in minutes. Keep a one-page description of the curriculum that maps topics to the risks they address, since an auditor or underwriter is often trying to establish that the content was relevant rather than merely present.

Where a specific framework or insurance carrier is involved, confirm their particular requirement with them rather than assuming. Frameworks that require security awareness training describe the obligation in general terms, and carriers word their questionnaires in their own way. Being able to produce completion records and a topic outline quickly is the part you control, and it is the part that decides how the conversation goes.

Measuring whether the program is working

Completion percentage tells you the training was assigned and finished. It does not tell you whether anyone would now stop a payment. The measures that matter are behavioral, and most of them are already visible in your own operations.

• Reporting rate. Are suspicious emails being reported at all, and is the number rising? A workforce that never reports is not a workforce that never sees fraud.
• Time to report. The gap between receipt and report is the variable that determines whether money can be recalled.
• Verification compliance. For supplier and payroll changes, can you show the callback happened? Sample a few and check the note is in the file.
• Near misses. Requests that were stopped before payment are the most useful data you have, because they show exactly which variant is currently reaching you.
• Simulation results over time. If you run them, watch both clicks and reports, and look at the trend rather than any single result.

Feed what you learn back into the content. If three people report the same fake invoice, that is a signal to send a short note to everyone and to refresh the module. The program improves because it is listening, not because it is repeated.

Where to start this month

If nothing is in place, do the smallest useful version. Write down the verification routine and the two-person rule, tell everyone in one message, and name the reporting channel. Then assign the training, so the routine is taught with worked examples rather than described in a memo.

The phishing and social engineering course covers the variants and signals described here, in short modules written for everyday employees rather than security specialists. For finance and leadership, the executive wire fraud prevention course goes deeper on payment change requests and authority pressure. If you are building the wider program around it, this step-by-step guide to building an awareness program covers scope, cadence and documentation. Both courses issue a completion certificate, and the platform tracks who has finished, sends reminders, and exports the records when an auditor, client or insurer asks. Team training starts at $0 per seat per year as stated on the homepage, and the wider catalog is on the cybersecurity training page.