When should an executive approval request be verified through a second path?

Abstract

The FBI describes business email compromise as a fraud pattern built around trusted business communications, and CISA explains how phishing begins the attack cycle [1][2]. NIST identity and zero-trust guidance adds a crucial distinction: authenticating an account does not prove that every requested action is appropriate [3][4]. Executive offices therefore need action-based verification for unusual or consequential requests, not confidence based only on tone, display name, or message history.

Methodology

This synthesis compares ten FBI, CISA, NIST, and GAO sources covering business email compromise, phishing, authentication, authorization, internal control, fraud risk, and incident response [1][2][3][4][5][6][7][8][9][10]. It proposes a risk-based operating model, not a guarantee against fraud or a substitute for security and financial controls.

Verify the action, not merely the sender

A valid login can still be misused, and a familiar thread can contain a malicious message. The question is whether the requested action matches the sender’s authority, the usual process, and the surrounding facts. High-consequence calendar, access, data-release, vendor, and payment-related changes deserve a stronger check than routine coordination [1][4][5].

Define triggers before pressure arrives

Useful triggers include a new destination, changed contact details, secrecy, unusual urgency, bypassed review, unfamiliar device context, or a request outside the person’s normal authority. Predetermined triggers reduce the chance that status or urgency will override judgment. They should route the assistant to a named owner rather than force an improvised investigation.

Use an independent path

Replying in the same thread does not create independence. Verification may use a known phone number, a separate approved channel, or an authorized second approver whose contact information comes from a trusted directory [2][3][6]. Multifactor authentication protects account access, but it should not be represented as approval of the business action itself [6].

Preserve evidence and avoid amateur remediation

Record the request, verification attempt, decision owner, and outcome according to policy. If compromise is suspected, avoid forwarding broadly, confronting a suspected actor, or changing systems without the security response owner. NIST incident guidance emphasizes preparation and coordinated response [8], while GAO fraud guidance supports designed preventive and responsive controls [9].

Measure exceptions, not employee suspicion

Track trigger type, time to verify, false positives, bypass attempts, and repeat process gaps. Review whether legitimate urgent work can still proceed through an authorized alternate path. The control should make unusual actions safer without turning routine executive support into indiscriminate surveillance [7][10].

Key findings

  • Familiar-looking business messages can carry fraudulent requests [1][2].
  • Account authentication and action authorization answer different questions [3][4].
  • Predetermined verification triggers reduce pressure-driven exceptions.
  • A second check should use contact data outside the questioned message path.
  • Suspected compromise belongs with named security and business-response owners [8][9].

Sources

  1. Business Email Compromise: The 55 Billion Dollar Scam, FBI Internet Crime Complaint Center
  2. Phishing Guidance: Stopping the Attack Cycle at Phase One, Cybersecurity and Infrastructure Security Agency
  3. Digital Identity Guidelines, National Institute of Standards and Technology
  4. Zero Trust Architecture, National Institute of Standards and Technology
  5. Security and Privacy Controls for Information Systems and Organizations, National Institute of Standards and Technology
  6. Require Multifactor Authentication, Cybersecurity and Infrastructure Security Agency
  7. Cybersecurity Framework 2.0, National Institute of Standards and Technology
  8. Cyber Guidance for Small Businesses, Cybersecurity and Infrastructure Security Agency
  9. Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data, Cybersecurity and Infrastructure Security Agency
  10. Risk Management Framework for Information Systems and Organizations, National Institute of Standards and Technology

Return to the Research Content library