Free Business Email Compromise (BEC) Checklist:
See If Your Business Can Stop a Wire Fraud Attack

A BEC checklist is a structured self-audit of the process and technical controls that stop business email compromise attacks. A complete checklist covers the eight areas most exploited in real BEC incidents: out-of-band verification on wire requests, dual approval for high-dollar transfers, DMARC enforcement on your email domain, MFA on finance and executive mailboxes, spoofing awareness training, a verified process for payroll changes, a written fraud response plan, and periodic review of email forwarding rules. The interactive tool at the top of this page walks through all eight and gives you a scored result.

An attacker sends a carefully crafted email that appears to come from a trusted source, your CEO, a vendor, your bank, or a colleague. The email requests an urgent wire transfer, a change to a vendor’s bank account, or a payroll update. Because the request looks legitimate and often cites real context, the target follows the instructions and the money moves. BEC doesn’t require hacking your systems: it exploits trust, urgency, and the gap between “looks right” and “is right.”

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a technical standard that tells receiving email servers what to do when someone sends email that claims to come from your domain but fails authentication. Without a `p=quarantine` or `p=reject` policy, an attacker can impersonate your company and send convincing fraudulent emails to your vendors, partners, or employees. Enforcing DMARC closes the spoofing door at the domain level, it doesn’t stop all BEC (attackers also use compromised accounts and lookalike domains), but it eliminates one of the most common entry points.

Act within the hour: first, call your bank’s fraud line and request a wire recall or payment stop. Second, file a complaint at ic3.gov immediately, the FBI’s Financial Fraud Kill Chain can freeze funds in transit, but only if it’s activated fast. Third, preserve every email related to the transaction without altering them. Fourth, notify your IT provider to secure the affected email accounts and check for hidden forwarding rules. The first two steps are time-critical. Most businesses that lose the recovery window do so because they wait until the next business day.

Most cyber insurance policies include some social engineering or funds transfer fraud coverage, but coverage limits, sublimits, and conditions vary widely. Many policies require that specific internal controls were in place at the time of the incident, dual approval, call-back verification, and MFA are commonly listed requirements. Check your policy’s social engineering endorsement and funds transfer fraud section before an incident, not after.

Phishing is broad, it typically sends the same malicious link or attachment to a large list of targets hoping someone clicks. BEC is targeted and financially specific: the attacker researches your business, impersonates a known contact, and crafts a single email designed to trigger one financial action. BEC rarely involves malware; the entire attack is in the email itself. Because there’s nothing technical to block at the endpoint level, process controls (verification, dual approval) and email authentication (DMARC, MFA) do most of the work.

Yes. Smaller businesses are targeted because they typically have fewer internal controls and less scrutiny on payment requests. The average BEC incident loss does not scale by company size, a 20-person firm wiring $80,000 to a fraudster loses the same $80,000 as a larger company. The attack is simple enough to run against any business that wires money, pays vendors, or runs payroll.