CIS Logo
tagline: Confidence in the Connected World

Security Primer – Business Email Compromise

State, local, tribal, and territorial (SLTT) governments are frequently targeted by Business Email Compromise (BEC) scams that attempt to deceive victims into sending money, or personally identifiable information (PII), modifying direct deposit information, or use the government’s name to fraudulently obtain material goods. The variants targeting SLTT governments include the direct deposit variant, the financial theft variant, W-2 and PII variant, and the purchase order fraud variant. The emails often originate from compromised, spoofed, or fraudulent accounts, which are used to issue a request and are associated with significant data and financial loss.


  • Craft a policy for identifying and reporting BEC and similar phishing email scams. Make sure to include the following components.
    • When receiving unusual financial or sensitive data requests, users should verify the identity, authenticity, and authority of the email sender via non-email channels.
    • Users should ensure that the email is going to the correct person. The true recipient of an email can often be verified by hovering the mouse over the address in the email header.
    • Users should reply by forwarding, and not by hitting the “reply” button, which helps to prevent successful spoofing attacks.
  •  Train staff in the human resource and finance departments to identify potential BEC scam emails and follow the suspicious email policy. Indicators of BEC spam emails can include:
    • Poorly crafted emails with spelling and grammar mistakes.
    • The wrong or an abbreviated signature line for the supposed sender.
    • The use of full names instead of nicknames and a language structure may not match how the supposed sender normally communicates.
    • That the only way to contact the sender is through email. The transactions are for a new vendor or new contact at a known vendor.
  • Develop a BEC Incident Response Plan including emergency contacts with at the appropriate financial institutions in case it becomes necessary to stop a transfer.
  • Ensure human resource and finance department employees have a policy for out-of-band verifications (e.g. verbal confirmations, etc.) of direct deposit, account changes, or wire transfer requests. Collaborate with human resource and finance departments to ensure their policies are supported by technological solutions.
  • Flag emails from external sources with a warning message in the subject line.
  •  Implement filters at your email gateway to filter out emails with known phishing attempt indicators and block suspicious IPs at your firewall.
  • Refer to the MS-ISAC’s primer on Spear Phishing for other recommendations.
  • Report BEC scams to the MS-ISAC, local law enforcement, and the Internet Crime Complaint Center (IC3). Tax-related suspicious emails should be reported to the IRS. If there is a financial loss, notify the bank to stop payment and involve local law enforcement.

The MS-ISAC is the focal point for cyber threat prevention, protection, response, and recovery for the nation’s state, local, tribal, and territorial (SLTT) governments. More information about this topic, as well as 24x7 cybersecurity assistance is available at 866-787-4722, The MS-ISAC is interested in your comments - an anonymous feedback survey is available.