SOURCE READING
Original and translation
The excerpt and translation use the primary source below. Further references inform SHIO’s analysis.
Primary source
- Original title
- Business Email Compromise
- Original author / institution
- Federal Bureau of Investigation
- Source language
- English
- Original publication date
- Original publication date not provided
Selected passages from the primary source, with independent SHIO translations; not the whole work. The SHIO analysis below is separate from the original and implies no institutional endorsement.
Basis for use：公有领域政府文字（第三方材料及标识除外） / U.S. government text; third-party material and marks excluded
This edition uses the source language, so the original appears once.
Business email compromise (BEC) is one of the most financially damaging online crimes. It exploits the fact that most of us rely on email to conduct both our personal and professional business.Verify payment and purchase requests in person if possible or by calling the person to make sure it is legitimate. You should verify any change in account number or payment procedures with the person making the request.SHIO analysis
Make payment verification an ordinary part of cooperation
The following is SHIO’s independent judgment and discussion of methods. It is separate from the source text and its translation.
SHIO reading note
A familiar supplier’s request to change bank details needs a defined response. Undated FBI and Federal Trade Commission guidance provides a basis for considering how a small team can incorporate verification into everyday work without leaving each employee to improvise.
The central idea
SHIO’s judgment: agree the checking process in advance so staff can pause a payment under an established rule.
Verify the request as well as the sender
The FBI explains that business email compromise can involve lookalike addresses or compromised correspondence. It recommends verifying payment requests and changes in bank details in person or by phone. Pressure to act quickly is a warning signal, rather than a substitute for confirmation.
SHIO proposes agreeing a verification contact and established communication channel when a supplier relationship begins. A later change should be checked through that saved channel. Making this a shared operating step can reduce the pressure on an employee to decide, alone and under time pressure, whether challenging a request will damage the relationship.
Assign technical and operational responsibilities
The FTC describes email authentication tools including SPF, DKIM and DMARC. It also recommends internal policies requiring telephone confirmation of emailed wire requests. Its guidance therefore addresses technical configuration and human procedures as separate parts of the work.
SHIO suggests assigning responsibility for checking the email provider’s configuration and maintenance scope, and separately for approving and recording bank-detail changes. One person may hold both roles in a small firm, but the decisions should remain explicit. Buying a service cannot itself establish that an individual payment has been authorized.
Give a payment pause an owner
A SHIO exercise would assume that a manager is travelling when a supplier demands a same-day account change to prevent a delivery delay. Establish who can pause, who contacts the existing representative, what evidence permits resumption and where to escalate if nobody responds. This is a hypothetical exercise, not a reported incident.
The exercise should test whether the process works, rather than whether staff remember a slogan. Records should avoid unnecessary sensitive data. No procedure guarantees prevention, and an actual incident requires prompt appropriate assistance. For SHIO, reliable cooperation includes a confirmation process both parties accept and a reasonable pause that frontline staff are allowed to make.
A question for practice
Next step: document the contact, channel, pause authority and escalation route for the next bank-detail change, then rehearse it internally.
REFERENCES & EDITORIAL NOTE
Sources & further reading
The source’s original title, author and basis for use appear in the source section. Excerpts, SHIO translations and independent analysis are clearly separated. References include the primary source and supporting material for checking the evidence and its context.
Federal Bureau of Investigation · Primary source
Business Email Compromise
Original source date：No publication date providedAccessed：FBI policy says unattributed Bureau-provided information is public information and may be distributed/copied, subject to restrictions on seals and implied endorsement. These selected passages are official unattributed explanatory/protective text; no seal, photo or third-party contribution is reproduced. Selected excerpt with independently provided SHIO translations, clearly separated from SHIO analysis; not full-work reproduction or translation. Source and institution credited; no institutional endorsement or authorization asserted. Rights information: https://www.fbi.gov/privacy-policy
Federal Trade Commission
Cybersecurity for Small Business — Email Authentication and Business Email Imposters
Original source date：No publication date providedAccessed：FTC official Business Blog explains that nearly all FTC site materials are public domain: https://www.ftc.gov/business-guidance/blog/2018/03/1000-posts-whos-counting-we-are-actually. Only agency-authored guidance is summarized; no images or third-party material reproduced. Original editorial analysis, no full translation.