Business Email Compromise in Orange County: A Payment-Verification Playbook for Local Businesses

Where the fraud enters the process

A BEC scheme may target:

• vendor bank-account changes;
• invoices and accounts payable;
• executive wire requests;
• payroll direct-deposit changes;
• tax or accounting communications;
• escrow and real-estate funds;
• legal settlement or trust-account instructions;
• construction draw and subcontractor payments;
• nonprofit grants or donations;
• insurance or benefits payments; and
• gift-card or purchasing requests.

The attacker may study real conversation history, invoice timing, roles, travel, and vendor relationships. Good grammar or familiarity with a project is not proof that the sender is legitimate.

The payment-verification rule

Treat any change to payment destination, payment method, authorized contact, or urgency as a separate high-risk transaction.

Verification should use:

1. a known contact method obtained before the request—not the phone number, link, or reply address in the message;
2. a second authorized person for approval;
3. a documented hold long enough to complete verification; and
4. an auditable record of who verified what, with whom, when, and through which known channel.

If a vendor emails new banking instructions, call the vendor using a trusted number from the contract, approved vendor master record, or established contact directory. Do not use a number supplied in the change message.

A practical workflow

Step 1: detect the trigger

Flag:

• new or changed bank details;
• a first payment to a recipient;
• unusual urgency or secrecy;
• request to bypass normal approval;
• unexpected change in communication style or channel;
• last-minute change near closing, payroll, or delivery;
• invoice amount, timing, or purchase order mismatch;
• reply-to address different from the sender domain;
• new phone number in the message; and
• pressure tied to executive travel, litigation, or a confidential deal.

Step 2: hold the transaction

Do not “verify while processing.” Stop release until the check is complete. The hold should apply even when the message appears to come from a senior executive.

Step 3: verify through a known channel

Use a trusted directory, contract, prior verified record, or established relationship. Ask a specific question about the requested change. For high-risk transactions, require confirmation from two known contacts or an approved vendor portal.

Avoid yes/no confirmation such as “Did you send this?” if a mailbox or phone channel may be compromised. Confirm the old and new payment instructions, effective date, reason for change, and authorized requester.

Step 4: require dual approval

Separate:

• person entering or changing payment details;
• person verifying the request; and
• person releasing the payment.

Small organizations may not have three people. At minimum, ensure one person cannot request, verify, change, and release the same transaction without independent review.

Step 5: record evidence

Record:

• original request;
• transaction and vendor;
• risk trigger;
• trusted contact source;
• date and time of verification;
• person contacted;
• verifier and approver;
• result;
• any exception; and
• payment release.

Do not place sensitive full bank-account details unnecessarily into email or tickets.

Step 6: monitor the first changed payment

After an approved change, confirm receipt through the known contact and review for additional change attempts. Some organizations use a small test transaction where appropriate, but that should not replace identity and authorization checks.

Secure the vendor master

The vendor master record is a control point. Protect it with:

• role-based access;
• MFA;
• change approval;
• change logging;
• duplicate-account detection;
• review of dormant vendors;
• separation of entry and release;
• periodic export and review of recent changes; and
• alerts for changes near scheduled payments.

An email-security control cannot compensate for an accounts-payable system where one compromised user can change bank details and release funds.

If money may have been sent

Act immediately:

1. Contact the financial institution through a known number and request a recall or hold.
2. Notify the organization’s incident-response, finance, legal, and executive contacts.
3. Report the incident promptly to the FBI Internet Crime Complaint Center.
4. Preserve the email, headers, audit logs, sign-in records, mailbox rules, payment records, and communication timeline.
5. Secure affected accounts and sessions using an evidence-informed plan.
6. Notify cyber insurance and law enforcement as required by policy and counsel.
7. Determine whether personal, confidential, regulated, or client information was involved.
8. Warn relevant business partners through trusted channels without spreading unverified details.

The IC3 annual report describes the FBI’s Financial Fraud Kill Chain process and emphasizes quick reporting for financial-fraud recovery efforts. Recovery is not guaranteed, which is why immediate action matters.

Metrics that show the process works

• percentage of payment changes independently verified;
• exceptions to dual approval;
• vendor-master changes reviewed;
• time from suspected fraud to bank notification;
• finance and executive users protected with approved phishing-resistant authentication;
• suspicious mailbox rules detected and resolved;
• employee simulation or exercise findings; and
• repeat process failures.

Make payment verification part of security

OC Security Audit can review the intersection of Microsoft 365, identity, email, vendor access, incident response, and business payment controls. Contact OC Security Audit to discuss a focused assessment.

Prepared and reviewed by Ali Hassani, CISO, based in Irvine, California.