Business email compromise escalation path

Overview

BEC wires fraudulent payments—speed and legal tie-in matter more than malware IR sometimes.

Immediate

Freeze transfers initiated; notify bank fraud line; page finance lead on secondary channel—not email.

Technical

Mailbox rule audit on executives; session revoke; password + MFA reset; device isolation if malware suspected.

External

FBI IC3 / local cybercrime units per counsel advice.

Post-incident

Refine out-of-band wire verification policy; simulate in training quarterly.