Business email compromise (BEC) scams cost victims nearly $3.05 billion in 2025, according to the FBI’s 2025 Internet Crime Report. That puts BEC second only to investment fraud in total reported losses.
In a BEC scam, criminals take over email accounts or pose as someone trusted to trick employees into sending money or sensitive data. Businesses that work with outside vendors or send wire transfers regularly are frequent targets.
Small businesses get hit often. Attackers target them because they tend to have fewer safeguards: often no IT department, shared passwords, and a few people handling everything. Their money, customer records, and vendor relationships are just as valuable to an attacker as a large company’s.
The good news is that you don’t need a security team to protect your business. This guide covers five controls that help block most email-based attacks, along with simple first steps for each one.
Why Email Is the Easiest Way Into a Small Business
Email is where a lot of your business actually happens. Invoices go out, payments get approved, passwords get reset, and customer information gets shared, often all before lunch. Anyone who gets into that flow can see how your business runs and who handles the money.
Most email attacks rely on tricking people. An attacker has no reason to hack a server if they can convince your bookkeeper to wire money to a new account. A message that looks like it came from a trusted vendor or your own manager can do far more damage than a virus.
AI has made these scams harder to catch. Phishing emails used to give themselves away with typos, awkward phrasing, and generic greetings. Now attackers can use AI tools to write polished, personalized messages in seconds. The FBI’s 2025 report tied more than $30 million in BEC losses to scams with a confirmed AI connection.
The Five Controls That Matter Most
Each control below covers a different weak spot. Together, they make it much harder for an attacker to get into your accounts, pretend to be you, or trick your team into sending money.
Turn on Multifactor Authentication Everywhere
Multifactor authentication (MFA) asks for a second proof of identity after a password, like a code from your phone. If someone steals or guesses a password, MFA makes it much harder for them to log in. Most business tools already offer it for free.
Start with these accounts:
- Email: Your inbox is the recovery point for almost every other account. If an attacker controls it, they can reset passwords for your other tools.
- Banking: Turn on MFA for every business bank account and payment platform. This puts an extra barrier between an attacker and your money.
- Marketing platform: Your email marketing tool holds your customer list and can send messages in your name. A hijacked account can send phishing emails to everyone who trusts your brand.
Prioritize admin accounts and anyone who handles payments, since those logins carry the most risk. When you can, choose an authenticator app like Google Authenticator or Microsoft Authenticator over text message codes. Attackers can intercept texts through SIM-swapping scams. Physical security keys, such as a YubiKey, offer even stronger protection for your most important accounts.
Authenticate Your Email Domain
Email authentication proves that messages sent from your domain actually came from you. Without it, anyone can send an email that looks like it came from your business, and your customers and vendors have no easy way to tell.
These three settings work together to protect your domain:
- SPF (Sender Policy Framework): SPF is a list of the servers allowed to send email for your domain.
- DKIM (DomainKeys Identified Mail): DKIM adds a digital signature that proves an email really came from your domain and wasn’t changed along the way.
- DMARC (Domain-based Message Authentication, Reporting, and Conformance): DMARC tells receiving mail servers what to do with emails that fail SPF or DKIM checks, such as sending them to spam or rejecting them.
These records live in your domain’s DNS settings. Your domain registrar or email provider usually has step-by-step guides, and many can set up SPF and DKIM for you. A safe first step with DMARC is a monitoring-only policy, which shows you who’s sending email as your domain before you start blocking anything.
There’s also a practical reason to handle this now. Gmail and Yahoo began requiring SPF, DKIM, and DMARC for bulk senders in 2024, and Microsoft started enforcing similar new bulk sender requirements for Outlook in 2025. These rules apply to senders of roughly 5,000 or more messages a day, but all three providers recommend authentication for everyone. If you send newsletters or promotions, it also helps your messages reach the inbox.
Control Who Has Access
The more people who can log in to an account, the more ways an attacker can get in. Access control means each person gets only the access they need, for only as long as they need it.
These steps tighten access without slowing your team down:
- Individual logins: Give each person their own login instead of sharing one password. Shared passwords get passed around, written down, and rarely changed, and you can’t tell who did what.
- Role-based permissions: Most shared tools, like Google Workspace, Microsoft 365, and accounting software, let you assign roles. A part-time contractor probably doesn’t need admin rights or access to payroll.
- Same-day offboarding: Remove access on the day someone leaves. Keep a simple list of every tool each person uses so nothing gets missed.
A password manager helps with all of this. It lets your team create strong, unique passwords and share access to specific accounts safely.
Verify Money and Data Requests Outside Email
This control catches BEC scams that make it past every other defense. The rule is simple: never trust an email alone when money or sensitive data is on the line.
Put these two rules in place for your team:
- Call to confirm: Confirm any payment, wire transfer, or bank detail change by phone. Use a number you already have on file instead of one listed in the email.
- Second approver: Require a second person to approve payments over a set amount. Pick a threshold that fits your business, such as $1,000 or $5,000.
Write these rules down and apply them to everyone, including the owner. Attackers often pose as executives and pressure staff to skip steps, so a clear policy gives employees permission to slow down and check.
Train Your Team to Spot Phishing
Your team is the last line of defense when a convincing email slips past your filters. Good training helps people pause before they click a link, open an attachment, or send a payment.
A few habits help training stick:
- Keep it short & regular: A 10-minute refresher every month or quarter works better than one long annual session. Frequent reminders keep phishing top of mind.
- Cover the red flags: Teach people to watch for urgency, unusual requests, and lookalike sender addresses. An email from a slightly misspelled domain or a sudden request for gift cards should always get a second look.
- Make reporting easy: Give your team a simple way to flag suspicious emails, like forwarding them to one person. Thank people for reporting, even false alarms, and never blame someone who clicked, since fear of getting in trouble keeps people quiet.
What to Do if Something Gets Through
Even with good controls in place, mistakes happen. Acting quickly limits the damage and gives you the best chance of getting money back.
If you think an account was compromised or money went to a scammer, take these steps right away:
- Secure the account: Change the password for the affected account, sign out of all active sessions, and turn on MFA if it wasn’t already on. Check for new forwarding rules or recovery email addresses an attacker may have added.
- Call your bank: Contact your bank immediately if money moved. Banks can sometimes stop or reverse a transfer, but only if they hear about it fast.
- Report the incident: File a complaint with the FBI’s Internet Crime Complaint Center (IC3). Reports help law enforcement track scams and can support efforts to recover funds.
You can file a report online at ic3.gov. Include as much detail as you can, such as the emails involved, the dates, and any bank account or transaction information.
Start With One Control This Week
Each of these controls closes a different gap. MFA keeps a stolen password from being enough to log in. Domain authentication stops attackers from sending email that looks like it came from you.
Access control limits who can get into your accounts and cuts off people who’ve left. Verifying requests by phone stops fraudulent payments before the money is gone. Regular training helps your team recognize a scam before they act on it.
You don’t have to tackle all five at once. MFA is the fastest win, and you can turn it on for your email and bank accounts in an afternoon. Pick one account today, then keep building from there.
