Business email compromise defense for bookkeepers.
Use this workflow when your team handles vendor bank-change requests, fake invoices, and urgent ACH/wire approvals. The goal is simple: pause, verify off-thread, inspect mailbox artifacts, document, then approve or escalate.
A vendor asks for new banking details right before payroll or month-end close.
Attackers win when the business treats a payment change like a normal email. This page turns it into a repeatable approval system.
The four-part verification system.
Pause the payment change
Turn this into a written checkpoint before money leaves the business.
Call a trusted number already on file
Turn this into a written checkpoint before money leaves the business.
Check the mailbox for forwarding rules and OAuth grants
Turn this into a written checkpoint before money leaves the business.
Document evidence before approving or escalating
Turn this into a written checkpoint before money leaves the business.
Signals that make the request high-risk.
Email mismatch
Display name, reply-to, domain spelling, invoice footer, or payment details do not match previous records.
Urgency pressure
The message pressures staff to bypass normal approval because of a deadline, angry vendor, or executive request.
Mailbox artifacts
Forwarding rules, filters, OAuth grants, new logins, deleted threads, or hidden replies suggest account compromise.
Related BEC resources.
Get the free payment-change verification checklist.
Send it to the person who approves invoices, ACH, wires, or vendor bank changes.
Want the workflow instead of another article?
Get the Business Email Compromise Defense Pack, request a free teardown, or download the checklist and capture the process for your team.
Add done-with-you setup.
If you want the first version adapted, tested, and documented, start with setup help.