Why executive office verification must extend beyond email
Abstract
The FBI describes business email compromise as a sophisticated scam aimed at legitimate transfer-of-funds workflows. [2][3] IC3 complaint data documents substantial reported losses, but complaint totals are not a probability forecast for one company. [1] Executive offices should treat unusual payment, credential, and sensitive-record requests as identity and authorization problems, not simply as suspicious wording.
Methodology
This review uses the FBI and IC3 for threat description, reporting, and aggregate complaint evidence. [1][2][3] CISA sources frame phishing defenses, while NIST identity, zero trust, incident response, and risk guidance provide control principles. [4][5][6][7][8][9] FTC reporting is included as a separate reporting route. [10] Loss figures are not divided by business counts or used to claim an incident rate.
The attack follows a real business process
BEC succeeds when a message enters a workflow that already moves money, changes account details, releases records, or buys goods. The FBI examples include altered payment instructions and executive impersonation. [2][3] Familiar names, urgency, and accurate context can all be present.
An assistant may be targeted because the role connects executives, finance, vendors, travel, and outside stakeholders. The control objective is not to distrust every message. It is to require stronger proof when the requested action has higher consequence.
Independent verification breaks the message loop
For a new beneficiary, changed payment destination, unusual purchase, credential reset, or sensitive disclosure, verify through a previously trusted channel. Do not use a phone number or link supplied only in the request being checked. FBI guidance specifically emphasizes careful review and prompt contact with financial institutions after suspected loss. [2][3]
The expense exception escalation can define who confirms which changes, the evidence required, and who may approve an exception. A second person should not merely reread the same compromised thread.
Identity and authorization are separate
Strong authentication helps protect accounts, but an authenticated user may still be manipulated or an authorized account may be compromised. NIST identity guidance addresses authenticators and lifecycle controls, while zero trust guidance cautions against implicit trust based only on network location. [6][7]
Record the requester, verified identity, requested action, business purpose, authorized approver, destination, amount or data class, and verification channel. Minimize sensitive content in the log. The record should prove the decision path without creating a new collection of secrets.
Prepare the response before an incident
NIST incident-response guidance places preparation, detection, response, and recovery within broader risk management. [8][9] Executive support staff need a short route to security, finance, legal, the relevant bank, and leadership, with authority to pause an action while facts are checked.
If funds may have moved, contact the financial institution immediately and use the FBI reporting path. [2][3] Preserve the original message, headers, call notes, timestamps, and actions taken according to counsel and security direction. Do not investigate by replying to a suspected attacker.
Read complaint data with limits
IC3 reports reflect complaints received and reported losses, not all incidents and not audited financial statements for every complainant. [1] The multiyear exposed-loss figure in the 2024 advisory is a measure of reported exposure over its stated period, not expected loss for a specific executive office. [2]
A local control review should measure high-consequence requests, independent verifications completed, exceptions, near misses, time to escalation, and recovery tests. It should not grade employees on whether they were targeted. The system should make the safe action quick, clear, and supported.
Key findings
- BEC exploits legitimate payment and information workflows, often using impersonation or changed instructions. [2][3]
- Independent verification should use a trusted channel outside the request.
- Authentication does not replace transaction authorization.
- Response plans should connect executive support, finance, security, legal, and the financial institution.
- IC3 complaint data shows scale but does not predict one company's incident probability. [1]
Sources
- 2024 IC3 Annual Report, Federal Bureau of Investigation Internet Crime Complaint Center
- Business Email Compromise: The 55 Billion Dollar Scam, Federal Bureau of Investigation Internet Crime Complaint Center
- Business Email Compromise, Federal Bureau of Investigation
- Avoiding Social Engineering and Phishing Attacks, Cybersecurity and Infrastructure Security Agency
- Phishing Guidance: Stopping the Attack Cycle at Phase One, Cybersecurity and Infrastructure Security Agency
- Digital Identity Guidelines: Authentication and Lifecycle Management, National Institute of Standards and Technology
- Zero Trust Architecture, National Institute of Standards and Technology
- Incident Response Recommendations and Considerations for Cybersecurity Risk Management, National Institute of Standards and Technology
- Cybersecurity Framework 2.0, National Institute of Standards and Technology
- Report Fraud, Federal Trade Commission