Business email compromise tools fall into two families that rarely talk to each other. Email security tools, run by the CISO's team, try to stop the forged or hijacked message before anyone reads it: filtering, sender authentication, look-alike domain detection, account-takeover alerts on mailboxes. Payment controls, run by treasury and the wire room, try to stop the money once an instruction reaches the bank: holds on changed bank details, callbacks to numbers of known origin, second signatures. A business email compromise succeeds when both fail on the same instruction, which is why a bank needs both and should be clear which problem each tool solves. Botminds' Wire Fraud Prevention sits on the payment side, and its instruction origin agent reads the email the client acted on through the bank's email security gateway, so the evidence from the first family reaches the person deciding in the second.
The examples come from a fictional sample bank running the solution: Corvane National Bank, whose client Brightwater Mechanical received a forged "new bank details" email from its steel supplier on Thursday 22 October and keyed a $286,400.00 wire on the strength of it.
Two families of business email compromise tools, and what each can see
Email security (the message): Information security; at the client, its own IT or email provider
Wire room controls (the payment): Payments operations, treasury management and fraud
Email security (the message): Messages: senders, domains, links, attachments, mailbox sign-ins
Wire room controls (the payment): Payment orders and changes to payee details, against the client's own history
Email security (the message): Mass phishing, malicious links and attachments, spoofed sender addresses, suspicious mailbox access
Wire room controls (the payment): A new bank or account for a known payee, a first payment to a new payee, an amount far outside the pattern
Email security (the message): A clean message from a domain the fraudster registered and authenticated; a real mailbox already taken over
Wire room controls (the payment): Where the new details came from, unless someone reads the email behind them
Email security (the message): Before a person reads the message
Wire room controls (the payment): Before the wire is released, and before the client's cutoff
What tools prevent business email compromise?
No single tool prevents business email compromise; prevention takes a control on the message and a control on the payment. The FBI's own advice spans both. Its 2024 public service announcement on business email compromise tells businesses to "Use secondary channels and/or two-factor authentication to verify requests for changes in account information", which is a payment control, and to "Be alert to hyperlinks that may contain misspellings of the actual domain name", which is a message control.
FinCEN frames the bank's part of the job around timing. In 2016 it wrote that because such transactions are often irrevocable, "Identifying fraudulent transaction payment instructions before payments are issued is therefore essential to preventing and reducing unauthorized transactions". The wire room is the last place that can happen. Once a wire is sent, the problem becomes recall and tracing, the work of Wire Recall Management.
Does email security stop BEC?
Email security stops much business email compromise, but not the most careful kind. Filters and sender authentication are good at messages that pretend to come from a domain they do not. They are weak against a message that comes, perfectly authenticated, from a domain the fraudster actually owns, and against a message sent from a real mailbox the fraudster has taken over. The FBI's own definition now covers more than email: it describes schemes carried out by "compromising email accounts and other forms of communication such as phone numbers and virtual meeting applications".
The sample email is the first kind. It came from kesslersteeI.com, with a capital I in place of the lower-case l in the supplier's real domain, registered nine days earlier. It arrived as a reply inside the genuine invoice thread, and its sender authentication passed, because the checks confirm that a message came from the domain it claims, and this one did: the fraudster's own. A filter that relies on authentication would let it through. What gives it away is context: a domain younger than the relationship, a Reply-To pointing to a third domain, and a letter created at 11:52 p.m. the night before.
What the email gateway saw, read for the wire room
What is the difference between BEC protection and wire fraud detection?
BEC protection, in the usual vendor sense, protects mailboxes; wire fraud detection protects payments. The first asks whether a message is safe to deliver. The second asks whether a payment is safe to send, and in business email compromise that question has a better answer, because the payment carries something the message does not: the client's history with the payee.
In the sample wire, the email alone was ambiguous; companies do change banks. The payment made it clear. Brightwater had paid the supplier 11 times since 2021, always to the same account at Quillfield Bank, and today's instruction moved it to a savings bank in Houston it had never paid. Three of six fields had changed; the amount sat inside the usual range. A wire room that sees both the history and the email can decide in minutes. The questions to ask a wire fraud detection vendor are set out separately.
How do banks stop BEC payments?
Banks stop business email compromise payments by holding wires whose payee details changed, testing the change through a channel the fraudster does not control, and having two people decide. The controls are simple; making them happen before the cutoff is the hard part.
Payment-side controls that stop business email compromise wires
- Hold any wire whose payee bank details differ from the client's history
The commonest scheme changes only the account; amount rules miss it.
- Hold any change to a beneficiary template the same way
A changed template turns one forgery into a stream of payments.
- Call back at a number of known origin, and make the payee state its details
Never the number in the email or letter.
- Check the payee name against the account where you can
The Federal Reserve Banks' Payee Name Verification service checks a name against a routing and account number before payment.
- Two names on every release, stop and return of a held wire
With a supervisor's name above an amount the bank sets.
- Share what you learn with other banks under 314(b)
The same new account often appears in more than one victim's wire.
The name check deserves a word. The Federal Reserve Banks' Payee Name Verification service lets an institution verify an intended payee's name against a routing and account number before issuing a payment, using historical transaction data. It answers whether the account is the supplier's; a callback answers whether the supplier asked for the change. A fraudster who opens an account in a name close to the supplier's can weaken the first, which is why the second stays.
Sharing helps more than it looks. FinCEN's 2019 advisory reminds banks that under the USA PATRIOT Act's section 314(b) safe harbor, "financial institutions may share information surrounding BEC fraud" for identifying and reporting suspected money laundering. At the sample bank, the same receiving bank appeared in two clients' held wires on one afternoon, a supplier payment and $612,750 of seller proceeds from a title company, both changed by email.
What is vendor email compromise?
Vendor email compromise is business email compromise in which the criminal poses as, or takes over the mailbox of, a supplier and redirects the customer's payments to a new account. It is usually the costliest variant. FinCEN's 2019 advisory found that "Fraudulent vendor and client invoices are generally affiliated with larger BEC transaction amounts than even the CEO fraud scheme", likely because the payments they divert are large and recurring.
It is also the variant where the bank's position is strongest. A supplier relationship leaves a history, so a change of bank stands out; and a supplier has a known phone number, so a callback is possible. In the sample, the supplier's controller, called at the number in Brightwater's beneficiary template, said the supplier still banked at Quillfield and had sent no change, and the wire and the matching template change were both stopped. The callback that tested the account number is followed step by step in its own guide.
A vendor impersonation case, opened with the evidence attached
How much is lost to BEC each year?
Victims reported $3,046,598,558 in business email compromise losses to the FBI in 2025, on 24,768 complaints, an average of about $123,000 each (our arithmetic). That is complaint data: what victims chose to report, not a measure of all losses. Over a longer period, the FBI counted $55.5 billion in exposed losses worldwide from October 2013 to December 2023.
Business email compromise losses reported to the FBI, 2023 to 2025
A decade of business email compromise, as the FBI counts it
305,033
domestic and international incidents, October 2013 to December 2023
$55.5B
exposed dollar loss over the same decade
186
countries in which business email compromise has been reported
140+
countries receiving fraudulent transfers
For a bank, the more useful number is its own: how many wires it held for changed details last year, how many callbacks found a fraud, and how many released wires came back as recalls. That is the evidence a business case for either family of tool should rest on.
What a bank can ask its clients to do
The client's mailbox is where most business email compromise starts, and the bank does not run it. What a bank can do is set expectations in its treasury management agreements and in every conversation after a stopped wire. The FBI's list for businesses is short and specific: unique passwords for every service, a check that links in emails point to the business they claim to, settings on staff computers that show "full email extensions", and a habit of checking the sender's address, especially on a mobile device.
Three requests from the bank carry the most weight. Verify every change of a supplier's bank details by calling the supplier at a number already on file, before keying the payment. Tell the bank when a payee's details change, so a hold is expected rather than a surprise. And treat the bank's own callback as a second line, not a substitute for the client's check, since the bank sees only the wires that reach it.
The moment after a stop is when clients listen. At the sample bank, the relationship manager's message to Brightwater, drafted by the agents and checked by a supervisor before it went, told the client in plain words what had happened and what to do now: pay the supplier using the existing template, reset the clerk's email password and turn on two-step sign-in, and call the supplier's controller at the number on file. It contained no blame, no case number and nothing that would reveal a referral to the BSA team.
Where the two meet: the email behind the instruction
The two families meet at one artefact: the email or document that carried the new payment details. Email security has it; the wire room needs it. In most banks it travels between them, if at all, as a forwarded message or a screenshot, after a phone call between people who do not usually talk.
Wire Fraud Prevention reads that artefact directly. Through the bank's email security gateway, and from documents the client uploaded to the treasury portal, the instruction origin agent reads the headers, the Reply-To, the first server hop, the authentication results, the domain's age, the quoted thread and the document's metadata, and compares the sending domain with the client's known counterparties letter by letter. It never opens links or attachments outside its sandbox and never contacts anyone. Its findings sit beside the payment history on the held-wire screen, so the operator and the checker decide on both.
Splitting the job between the CISO and the head of payments
The CISO owns the message and the head of payments owns the wire, and business email compromise sits on the line between them. A bank buying tools should agree four things before it buys anything: who reads a suspicious instruction that reached a client, which system holds the evidence, who can stop a wire, and how fast the two teams can reach each other before a cutoff.
Three practical rules follow. Do not expect email security to stop a fraud that is authenticated by design; do expect it to supply headers and verdicts the wire room can read. Do not let the wire room's controls depend on the client's email security, which the bank does not run. And make the meeting point a screen, not a phone call. The wire fraud red flags a wire room can see before release are a useful shared vocabulary for both teams. To see the instruction origin screen beside the payment history, start from Wire Fraud Prevention.
Questions people ask
Is business email compromise the same as phishing?
Phishing is a technique; business email compromise is a fraud that often uses it. Phishing may harvest the credentials that let a fraudster take over a mailbox, and the fraudster then uses that mailbox, or a look-alike, to redirect a payment. Many business email compromise messages contain no link or attachment at all, only new bank details.
What is the difference between BEC and account takeover?
In account takeover the criminal uses the victim's own banking credentials to send the payment. In business email compromise the criminal deceives the victim's staff, who send it themselves. FinCEN drew that line in 2016, and it matters for liability: the first produces an unauthorised payment order, the second usually an authorised one.
Can a bank see the client's emails?
Only what the client sends or uploads to the bank, such as a letter attached to a payment request or an email forwarded with it, and messages that pass through the bank's own email gateway. Wire Fraud Prevention reads those; it does not reach into a client's mailbox.
Does AI make business email compromise harder to detect?
It makes the message more convincing, not the payment less unusual. The FBI reported that businesses lost over $30 million in 2025 to business email compromise involving AI. A changed account number after years of payments to the old one is just as visible when the email that carried it was written by a machine.
Who should a business call if it suspects a BEC wire has been sent?
Its bank, immediately, to request a recall, and then the FBI's Internet Crime Complaint Center at ic3.gov. The FBI's guidance is that "time is of the essence"; recovery depends on reaching the receiving bank before the money moves on.