The best defence against business email compromise is a rule nobody can override by email: any request to send money or change payment details is confirmed by a call to a number you already had. Executives and their assistants should both follow it, especially when the request claims urgency.
What the FBI says about the scam
The FBI's Internet Crime Complaint Center describes business email compromise, also called email account compromise, as targeting businesses and individuals who make legitimate transfer of funds requests. Scammers take over legitimate email accounts through social engineering or computer intrusion, then use them to make unauthorized transfers. Some variants also ask employees for personal information to compromise other accounts.
In its September 2024 announcement, the FBI reported 305,033 incidents and about $55.5 billion in exposed loss from October 2013 to December 2023, and noted that identified global exposed losses rose 9% from December 2022 to December 2023. Those are the FBI's figures for reports it received, not a full count.
The callback rule
Write it in one paragraph and give it to everyone who can approve or request payments, including executive assistants.
- Any new payee, changed bank details or urgent transfer is confirmed by phone.
- Call a number from your own records, not from the email or the invoice.
- Two people approve transfers above a threshold you set.
- No exceptions for seniority. The rule works because the CEO's own message cannot waive it.
- If the sender is "traveling" or "in a meeting" and cannot take a call, the payment waits.
The FBI's prevention advice supports the core of this: verify requests to change account information through a secondary channel or two-factor authentication.
Why assistants matter
Assistants often hold delegate access to an executive's mailbox and calendar, and they handle routine payment requests. An attacker who impersonates the executive will usually target the assistant, because the message looks normal. Make the assistant's authority to pause a payment explicit, and tell the executive in advance that being asked to confirm is never an insult.
Other FBI prevention advice
- Use unique passwords for each online service.
- Check that email links point to the claimed business and watch for misspelled domains.
- Never send login credentials or personal information by email, even when the request looks legitimate.
- Verify sender addresses, especially on mobile devices, and configure your mail client to display full email addresses.
- Monitor financial accounts regularly for irregularities.
If a payment went out
The FBI says to act quickly. Contact your financial institution right away to ask for a recall of funds, and file a complaint at ic3.gov as soon as possible, regardless of the amount. IC3 may help institutions and law enforcement freeze funds. For other payment types see what to do after paying a scammer.
Make the rule stick
Practice it once. Have someone send a fake urgent request to the assistant and see what happens. Treat the result as a process gap, not a person's failure.
Quick check
Is a call to the number on the invoice a valid callback?
No. Use a number from your own records, since the invoice may come from the attacker.
Who should follow the rule?
Everyone who approves or requests payments, including the executive and their assistant.
Sources
Last reviewed: 19 October 2026.
