An email claiming to be from a contact at a business partner says, "Our account for receiving payments has changed, so please pay this invoice and future ones to the new account." When business email compromise (BEC) is suspected, what is the most appropriate response?

Answer: B. Contact the business partner through contact details known from before (such as a phone number) by a means other than email, and confirm whether the account change is genuine

Business email compromise (BEC) is a fraud in which emails impersonating a business partner or the company's own executives get victims to send money to a fraudulent account. Attackers may take over the real contact's email account or use very similar domain names, so the sender's name, signature and even the content of past exchanges can look genuine. These emails often contain no malware or malicious links, so technical measures alone cannot stop them. The basic rule is to confirm important requests such as a change of payment destination by another means, such as a phone call, using contact details known from before rather than those written in the email. A phone number written in the email may connect to the attacker. Within the company, it also helps to set procedures such as requiring approval by more than one person to change a payment destination.

• A. The phone number in the email may have been set up by the attacker. Use contact details known from before to check.
• B. Correct. The basic rule is to confirm through known contact details by a means other than email.
• C. BEC uses hijacked accounts and signatures that look genuine, so a matching name and signature do not prove it is real.