Stop invoice and payment-change fraud before money leaves.
A practical AI-assisted workflow for suspicious emails, vendor spoofing, mailbox-rule abuse, ACH/wire changes, and post-incident cleanup.
One-time purchase. Unlimited internal use.
- Suspicious email triage worksheet
- Vendor payment-change verification SOP
- Mailbox compromise audit checklist
- Incident timeline and owner briefing templates
- Staff escalation script for bookkeepers and office managers
BEC is not a “big company” problem.
One rushed invoice can be expensive
Attackers do not need to hack your bank. They only need one believable vendor email at the wrong moment.
Office teams need a script
Bookkeepers and managers need a repeatable way to pause, verify, document, and escalate.
Email rules hide the damage
Compromised mailboxes often use forwarding rules, filters, and OAuth grants to hide replies and invoices.
The operating procedure inside the pack.
Classify the email or payment request
Risk-rate suspicious invoices, new banking details, urgent executive requests, links, attachments, and reply-to mismatches.
Verify identity and domain evidence
Check sender, reply-to, headers, SPF/DKIM/DMARC, domain age, lookalike domains, and link destinations.
Audit the mailbox after suspicion
Walk through forwarding rules, hidden filters, OAuth grants, login anomalies, and recovery setting changes.
Use out-of-band payment verification
Generate phone scripts and documentation steps that keep staff from verifying fraud through the same compromised email thread.
Document response and hardening
Create a timeline, owner/client notification draft, containment checklist, and post-incident hardening list.
Built for the businesses attackers actually target.
Local operators
- Contractors approving invoices
- Bookkeepers and accounting offices
- Law firms and real estate teams
- Agencies handling vendor payments
Common triggers
- “We changed our bank account”
- “Please wire today”
- Fake DocuSign / Microsoft login prompt
- Vendor thread suddenly changes tone or domain
Give your team a repeatable BEC defense workflow.
Use it inside Hermes, Claude, Codex, or any AI assistant as a security SOP. No passwords, no risky credential sharing, no fake certainty.