Protecting Your Company from Business Email Compromise 

October 30, 2026

Simple steps to help you spot suspicious requests and protect your business. 

Business email compromise (BEC) can put your company’s money and sensitive information at risk. The steps below can help your team spot suspicious requests, verify them, and respond quickly. 

What Is Business Email Compromise? 

BEC is a type of fraud in which a criminal impersonates someone you trust to persuade you or an employee to send money or share sensitive information. They may use a fake email address or take over a legitimate account, then make a request that seems believable coming from the person or organization they’re impersonating. 

Warning Signs to Watch For 

Be cautious when an email includes: 

• Urgency or pressure: A request to wire money immediately, keep the request secret, or act before a deal falls through. 

• Changes to payment instructions: New bank account, ACH or wire details, even if the message appears to come from a familiar vendor. 

• A look-alike email address: A small spelling or punctuation change that is easy to miss. 

• A request to bypass normal steps: Someone asks you to skip an approval process or handle a payment “confidentially.” 

• An unexpected link or attachment: A message prompts you to sign in to Microsoft, Dropbox, Docusign, or another service when you weren’t expecting it. 

• A change in tone or wording: The sender’s writing style, signature, or request feels different or unusual. 

The Most Important Step: Verify Payment Requests by Phone 

 
Before acting on a payment request or change in instructions, pause and reread the message. Does it sound like the person or company you know? If anything feels unusual, call to verify using a number you already trust, not one in the email or reply. Taking a moment to check is always better than risking a costly mistake. 

How Account Takeovers Fuel Business Email Compromise 

Many BEC attacks begin with a compromised inbox. Criminals use phishing to access an account, monitor conversations, and send fraudulent requests from a trusted address. Some also steal an active login session to get around multi-factor authentication. A few practical security measures, many available in tools your business may already use, can make these attacks much harder. 

Watch for Signs of an Account Takeover 

Contact your IT provider if you notice: 

• Email rules that forward messages to an unfamiliar address or move messages into unexpected folders. 

• Sign-in alerts or MFA prompts you didn’t initiate. 

• An unfamiliar MFA device, phone number, or connected app. 

• Sent or deleted messages you don’t recognize. 

• Customers or colleagues reporting unusual messages from your account. 

Practical Steps to Protect Your Business Payments, Accounts, and Team 

Your Payments 

• Verify payment changes by phone before updating account details. 

• Require a second approver for wires and large payments. 

• Ask your First Western Trust relationship manager or Treasury Management team whether safeguards such as Positive Pay, dual approval, or wire callbacks are available for your accounts. 

Your Accounts 

• Turn on multi-factor authentication (MFA) for email and banking. Where available, use phishing-resistant options such as passkeys or security keys. If those aren’t available, use an authenticator app with number matching rather than relying on text messages alone. 

• Use a password manager to create unique passwords for each account. 

• Don’t sign in through unexpected email links. Go to the service directly or use a saved bookmark. 

• Keep devices and software updated and enable automatic updates when available. 

Your Team 

• Encourage your employees to pause when a request feels urgent or unusual. 

• Check the full sender address, not just the display name. 

• Make it easy for employees to ask for a second opinion before acting on a request. 

• Provide regular security awareness training and a clear way to report suspicious messages. 

Everyday Habits to Help Prevent Account Takeovers 

• Never enter your password through an email link. Go directly to the website or use a saved bookmark. Even a legitimate sign-in page can be part of a phishing scam if you visit it through a suspicious email. 

• Use a password manager. It can create strong, unique passwords and typically won’t autofill them on a look-alike website, which can help flag a phishing attempt. 

• Keep administrator accounts separate. Use a standard account for everyday email and browsing, and reserve administrator access for tasks that require it. 

• Set up email authentication (SPF, DKIM, and DMARC). These settings help prevent criminals from impersonating your business’s email domain. Your IT provider can help configure them. 

• Review account access regularly. Remove access from former employees, close unused mailboxes, and check which apps can connect to your email. 

If You Suspect Fraud or an Account Compromise, Act Quickly 

• Contact us right away if a payment may be fraudulent. Call your First Western Trust banker using a known number. If funds have already been sent, contact the financial institution that sent them and request a recall. 

• Preserve the evidence. Keep the suspicious emails and related details for your bank, IT provider, and investigators. 

• Secure the account. Contact your IT provider to reset the password, revoke active sessions, review MFA settings, and remove unfamiliar rules, forwarding, or connected apps. 

• Report the incident. File a report with the FBI’s Internet Crime Complaint Center at ic3.gov. 

First Western Trust Is Here to Help 

We’re committed to helping you protect your business and its accounts. If you have questions or would like to discuss payment safeguards such as dual approval or Positive Pay, please contact your relationship manager or our Treasury Management team.