Incident Help

Business Email Compromise: Recognize It, Stop It, Recover From It

Business email compromise (BEC) doesn't look like typical spam — it looks like a normal email from someone you already work with, asking for something that seems reasonable at first glance. It's one of the most financially damaging categories of cybercrime specifically because it targets trust, not technology.

Scan a Link or Email — Free →

The most common BEC scams

  • Fake vendor bank-change requests — "our banking details have changed, please update your records," followed by an invoice to the new account.
  • Payroll diversion — an email appearing to be from an employee asking HR to update their direct-deposit details.
  • Executive wire-transfer requests — an urgent, confidential request appearing to be from a CEO or owner, often timed for when that person is known to be traveling.
  • Gift-card requests — a simpler version of the same trick, asking an employee to buy gift cards "for a client" and send the codes.

Red flags in a suspected BEC email

  • Urgency combined with secrecy ("handle this quietly, don't loop in anyone else").
  • A Reply-To address that doesn't match the sender's real domain.
  • A request to bypass your normal approval process "just this once."
  • A newly registered domain that's one character off from a partner you actually work with.

If you already sent money or changed payment details

Act immediately: call your bank's fraud department and ask about a wire recall, then contact Phenicie Business Management for incident help at (406) 957-1576. The faster this moves, the better the odds of recovering the funds or containing the damage.

Frequently asked questions

What exactly is business email compromise?
It's a scam where an attacker impersonates — or actually gains access to — a trusted email account (a vendor, an executive, a coworker) in order to redirect money, payroll, or sensitive data. Unlike mass phishing, BEC is often targeted and researched, sometimes over weeks.
We already sent money to a changed bank account. What do we do?
Time matters enormously here. Contact your bank's fraud department immediately and ask about a wire recall — many banks can stop or reverse a transfer within the first 24-48 hours, but the odds drop fast after that. Then contact Phenicie Business Management for incident help.
How do I verify a bank-change request is legitimate?
Never use the phone number or email address in the request itself to verify it — call the vendor or coworker using a number you already had on file before the request came in. If the request came by email, verify by phone, and vice versa.
Can TrustCan detect a BEC attempt?
TrustCan checks the specific signals BEC attacks rely on — Reply-To mismatches, lookalike domains, and links in the message — through our email header analyzer and phishing email checker. No automated tool catches every targeted BEC attempt, which is why verifying unusual financial requests by phone remains the most reliable defense.
Worried someone already clicked, downloaded a file, entered a password, or sent money? Contact Phenicie Business Management now at (406) 957-1576.

Someone interacted with a suspicious email or link?

Phenicie Business Management offers a free initial incident triage to help determine the next action.

TrustCan is a free tool from Phenicie Business Management, a Montana-based IT and cybersecurity provider.

Call (406) 957-1576