BEC Fraud Prevention Guide for Professional Services: Protecting Against Invoice and Payment Fraud
Business Email Compromise is the highest-value cybercrime affecting UK professional services firms. The pattern is consistent: attackers either compromise or spoof an email account, intercept a payment communication, and divert funds to a mule account before the fraud is detected. By the time the victim realises, the money is often overseas and unrecoverable. This guide provides a practical programme for preventing BEC in professional services firms.
Average BEC loss per incident in UK professional services: £28,000 — Action Fraud.
The Four BEC Prevention Controls
Four controls together provide strong BEC prevention:
- 1. Email authentication — DMARC at p=reject prevents attackers spoofing your domain to attack your clients; DKIM and SPF prevent spoofing of inbound email
- 2. Bank detail change verification — a documented procedure requiring phone verification to a known number before any change of payment details is actioned, regardless of how urgent the email instruction appears
- 3. Staff training — regular BEC awareness training including simulated phishing exercises; staff must know that urgent payment instructions received only by email are a red flag
- 4. MFA — multi-factor authentication on all email accounts prevents account compromise that enables the most sophisticated BEC attacks
The Bank Detail Change Verification Procedure
The single most effective procedural control is a mandatory verification call before actioning any change of bank details. The procedure must specify: (1) the verification call must be made to a known number — one already held on file, found independently on a website, or previously used — never a number provided in the email requesting the change; (2) the procedure applies regardless of who the email appears to be from, including the CEO or a senior partner; (3) no exceptions for urgency; (4) a record of the verification call must be kept.
Frequently Asked Questions
What should we do if we think we have been the victim of BEC?
Act immediately. Contact your bank using their fraud line and request a recall of the payment — banks can sometimes recover funds within 24 hours. Contact the recipient bank if known. Report to Action Fraud (0300 123 2040). Notify your cyber insurer. Secure your email accounts by changing passwords and reviewing email rules for forwarding rules set by the attacker. Do not delete anything — preserve email logs and system logs for forensic investigation.
Get a BEC vulnerability assessment
Kyanite Blue specialises in cybersecurity for iGaming operators. MGA-licensed operators across Malta trust our stack.
Get in touchReady to secure your iGaming operation?
MGA-licensed operators across Malta trust Kyanite Blue.