Business Email Compromise Prevention for Central Coast Offices

What business email compromise looks like

The patterns repeat. The details change to fit your business.

• Changed bank details: a vendor's email says their bank changed and asks you to pay the next invoice to a new account.
• Urgent owner request: "the owner" emails the bookkeeper asking for a quick payment and says not to call because they are in a meeting.
• Payroll diversion: an employee asks HR to change their direct deposit account.
• Closing or settlement payments: an escrow, title or attorney email shows up with new payment instructions days before a deal closes.
• Data requests: someone posing as a manager asks for W-2s or a client list.
• Gift cards: a "boss" asks for gift card codes for a client thank-you.

Two flavors matter. In one, the attacker uses a look-alike domain or a spoofed display name. In the other, the attacker is inside a real mailbox, yours or your vendor's, and the email is genuine. That second kind passes every "check the sender" test. It is the reason call-back verification is the center of this guide.

Harvest season and tax season: when the pattern shifts

Fraud follows busy seasons, because busy people skip steps.

Harvest runs from late summer into fall. Wineries in the Santa Ynez Valley and around Lompoc are paying for grapes, crews, trucking, barrels and bottles. Growers and packers in Santa Maria juggle labor contractors, cooling, packaging and freight. Census County Business Patterns for 2023 counts about 56 agricultural support businesses in Santa Barbara County alone, each one a vendor somebody pays. New vendors get added fast, owners approve payments by phone from the field, and a bank-change email lands right when nobody has time to check it.

Tax season, roughly January through April, shifts the target to accountants, tax preparers and anyone handling payroll. Expect fake "client" emails changing refund deposit details, requests for W-2 copies, and messages impersonating a firm's own staff. Tax preparers also carry duties under the FTC Safeguards Rule. See the FTC Safeguards Rule and WISP guide.

Put a reminder on the calendar two weeks before each season: re-read the payment rules with everyone who touches money.

Call-back verification: the control that does the most

Write this down as office policy, one paragraph long:

Any new payee, any change to bank details, and any urgent payment request outside the normal process is verified by phone before money moves. The number comes from the vendor file, a signed contract or a past invoice. Never from the email, its signature or a link in it.

How to run it:

1. Hold the payment. Do not reply to the email.
2. Look up the vendor's number in your own records.
3. Call and ask a specific question: "Did your company change its bank account, and what are the last four digits of the new account?"
4. Note the date, time, person spoken to and result in the vendor file.
5. If you cannot reach them, the payment waits.

Make it safe for staff to say no, including to the owner. An owner who says out loud "I will never be upset that you called to check" removes the attacker's best tool, which is urgency.

Payment process controls for a small office

• Two people for bank changes: one person enters a vendor bank change, a different person approves it.
• Waiting period: hold the first payment to changed bank details until the call-back is logged.
• Vendor file logging: keep a record of who changed what and when.
• Payroll changes: verify direct deposit changes in person or by calling the employee at a number already on file.
• Bank tools: ask your bank which fraud controls it offers business accounts, such as approval rules for new payees or payment limits.
• Email authentication on your own domain: publish SPF, DKIM and DMARC records so attackers have a harder time sending mail that looks like it comes from you.
• External sender tags: a banner on outside email helps staff notice a "boss" writing from an outside address.

Lock down the mailbox

Prevention also means making mailboxes hard to take over and quick to clean up.

• MFA on every account, with an authenticator app instead of text messages where possible.
• Automatic forwarding to outside addresses blocked.
• Inbox rules reviewed monthly, looking for rules that hide or delete payment-related mail.
• Alerts for new forwarding rules sent to someone who reads them.
• Sign-in history checked for locations you never work from.
• Registered MFA methods reviewed, since attackers add their own.

The Microsoft 365 security checklist walks through each setting. Google Workspace has close equivalents.

Training that fits a small office

A yearly slideshow does little. What works better at a ten-person office:

• A ten-minute talk before harvest and before tax season, using real-looking examples.
• A printed card next to whoever pays bills: "Bank change? Call the number on file."
• A short tabletop exercise: your largest vendor emails new bank details at 4 p.m. on a Friday. Who does what?

Keith Systems runs tabletop exercises and helps you write the plan behind them. See incident response readiness.

The first hour after a suspicious payment

Speed matters more than anything else here. Keep this list where the bookkeeper can find it.

1. Call your bank's fraud department now. Give the amount, date and receiving account, and ask them to try to recall the payment.
2. File a report with the FBI's Internet Crime Complaint Center (IC3). The FBI asks victims to report quickly.
3. Secure the mailbox. Reset the password, sign out all sessions, remove unknown MFA methods, and screenshot then delete any rogue forwarding or inbox rules.
4. Call the real vendor at a number on file. Their mailbox may be the one compromised.
5. Call your insurer or broker before hiring anyone. Many policies require you to use specific response firms.
6. Preserve evidence. Do not delete the emails. Keep the full messages with headers.
7. Write a timeline while memory is fresh.
8. Talk to legal counsel about notification duties if personal information was exposed. California's deadlines are covered in the 30-day breach notification guide.

Keith Systems focuses on prevention and readiness. It does not do forensic investigations. Jacob can help you build this plan and test it ahead of time. Book a free security consult or call (805) 800-8163.