Guide · Phishing & fraud

Spot the fake wire request: business email compromise (BEC)

By Christopher Smith, MS Cyber Security, penetration tester·Published October 18, 2026·Updated October 18, 2026·5 min read

Business email compromise is a payment instruction that looks routine until the money is gone. The Short gives one rule — verify out-of-band. This guide turns that rule into a payment process your bookkeeper, office manager, and owner can follow even when the request feels urgent and comes from a familiar name.

Quick verdict

• Urgency is the tell, not the proof. Secrecy, a rush, and a changed bank detail are reasons to slow down, not speed up.
• Verify out-of-band, every time. Call a number you already have on file — never the number, link, or reply thread in the requesting email.
• Two people for money movement. No single person should be able to both approve and send a wire, ACH change, or gift-card purchase.

How the fake request usually works

• An email appears to come from the owner, a senior manager, or a regular vendor. The display name looks right; the actual address or thread may not be.
• It asks for a wire, a change to vendor bank details, payroll diversion, or gift cards — often marked urgent or confidential.
• Follow-up pressure discourages checking: 'I'm in a meeting, just handle it.' That pressure is part of the script.

Protect the domain side too: SPF, DKIM and DMARC make it harder for outsiders to send mail that appears to come from your domain, though they do not replace payment verification.

A verification process a small team can actually run

1. Stop at money keywords: wire, ACH, bank change, routing, gift cards, payroll change. The process below applies before anyone acts.
2. Call a known number: use the number in your contacts, a prior invoice, or the vendor file — not the signature in this email.
3. Confirm the detail change verbally: for bank changes, confirm old and new details with the known contact and wait a defined cooling-off period before paying.
4. Second approver: a second named person reviews the request and the verification before release. For very small teams, that second check can be the owner by phone — but it must happen.
5. Write it down: keep a one-line payment-verification log. If it is not logged, it did not happen.

If money already left

Call your bank immediately and ask about recall options, then notify your leadership and preserve the original emails with full headers for investigators and your insurer. Time matters; do not spend the first hours only investigating internally. Afterwards, review how the request bypassed verification and tighten that exact step.

Bottom line

Urgency is the tell, not the proof. Secrecy, a rush, and a changed bank detail are reasons to slow down, not speed up. The expanded steps above turn the Short's rule into a process with an owner and a check — do the first section today, schedule the rest this week, and write down what you changed so the next person does not have to rediscover it.

Free next step: Get the Small Business Cybersecurity Checklist — download it now, or sign up there to get it by email and hear about new guides.