Business Email Compromise (BEC) is no longer a “big company” problem. In Hampton Roads, we see it hit construction firms, professional services, and manufacturers every month. The playbook is simple: impersonate a vendor, redirect a payment, disappear.
If one fake invoice clears your AP process, the loss is immediate and usually unrecoverable.
Below is the exact control stack we deploy for Virginia Beach businesses to shut BEC down.
1. Enforce MFA Everywhere (No Exceptions)
BEC starts with account takeover. If an attacker gets a password, they must still be blocked.
- Require MFA for every mailbox, including shared accounts.
- Block legacy protocols (IMAP/POP) that bypass MFA.
- Use conditional access to restrict logins by geography and device posture.
2. Kill Auto-Forwarding and Rogue Rules
Most wire-fraud cases include hidden inbox rules that forward messages outside your tenant or silently move vendor emails to junk.
- Disable auto-forwarding to external domains.
- Alert on inbox rules that delete or move finance emails.
- Review admin audit logs weekly for rule creation.
3. Lock Down Vendor Payments with Verification
Technology stops most threats, but payment fraud requires process.
- Add a verbal verification step for any banking change request.
- Maintain a known-good vendor list with verified contacts.
- Require two-person approval for wire transfers.
4. Turn on Advanced Phishing Defenses
BEC emails are clean—no malware, no links—just social engineering. Basic filters miss them.
- Enable DMARC, DKIM, and SPF to stop spoofed domains.
- Use impersonation protection to flag fake vendor domains.
- Quarantine emails with look-alike domains (e.g.,
acme-inc.comvsacmeinc.com).
5. Train the Finance Team First
Phishing training should be targeted. Your AP team is the primary target.
- Run monthly BEC simulations for finance and executive staff.
- Teach staff to verify reply‑to fields and domain spelling.
- Reward correct escalation, not just clicks avoided.
The Quick Test: Are You Exposed?
If any of these are true, you are at risk:
- Mailboxes without MFA.
- Auto-forwarding allowed to external addresses.
- No formal vendor change verification.
- No DMARC policy in place.
BEC is preventable. The fix is not a single tool—it is layered controls plus a payment process that assumes someone will try to impersonate a vendor.
If you want a fast assessment, we can review your Microsoft 365 tenant and finance workflow in one session.