Business Email Compromise Training: A Practical Guide

Your finance team finished its annual security module last month. Everyone passed. This morning, an accounts payable clerk opens a polite email from a regular supplier, complete with the right invoice number, asking her to update the bank account before Friday's payment run. There's no suspicious link to hover over and no spelling mistake to spot. The only real question is whether she's rehearsed what to do next.

That's where most business email compromise training fails. It teaches people to inspect messages, then leaves them alone at the moment a payment decision needs a pause, a callback, and a second approver. Treat training as rehearsal of payment controls, and you're measuring actions that stop money leaving.

The Six-Phase Build Sequence for BEC Training

Say that clerk has processed this supplier for two years. The new account details arrive in an existing thread, the amount matches the purchase order, and her manager wants the run closed. Judging the email won't save her. Following a written rule will.

The scale justifies building that rule properly. The FBI IC3 September 2024 public service announcement reported 305,033 domestic and international BEC incidents recorded between October 2013 and December 2023, with total exposed losses of $55,499,915,582. The FBI also describes BEC as using compromised email accounts and other channels, including phone numbers and virtual meeting applications, so an email-only course misses part of the attack.

Build in this order, because staff can't practice a safe action you haven't defined yet.

Why the order matters

Phase one names everyone who can initiate, approve, or alter a payment, including executive assistants and procurement staff who influence decisions without releasing funds. Phase two turns that map into behavior. If you simulate first, a failed test only tells someone they were fooled. It doesn't tell them which number to call or who can release a hold.

Practical rule: No simulation goes out until the verification standard names the callback source, the escalation owner, and who can lift a payment hold.

By the end of phase two, you should hold three artifacts. Keep them short enough to use under deadline pressure.

• Payment-authority map: Roles, systems, and approval limits in one list.
• Written verification standard: The exact pause, verify, escalate, report sequence for bank changes, payroll changes, and urgent wires.
• Named report owner: One accountable person or on-call rota, not a shared inbox nobody checks.

Threat Indicators Staff Should Recognize

A polished invoice arrives with correct branding, a real project name, and flawless grammar. The only anomaly is a new remittance account and a request to update records today. If your training taught staff to hunt for typos, they've just been trained to trust this message.

That gap is widening. FBI-linked reporting on the 2025 IC3 report identified more than $30 million in 2025 losses from BEC scams with a confirmed AI nexus, while total BEC complaints rose to 24,768 from 21,442 in 2024. Attackers now coordinate across email, Slack, messaging apps, and phone calls, and they can imitate writing style, voice, or profile well enough that familiarity stops working as proof.

Signals tied to a verification step

Teach each mechanism with the check that doesn't depend on the message itself. Technical controls against spoofing still matter, and our guide to how to stop spoof emails covers that layer, but a compromised genuine mailbox can pass those checks and still send fraudulent instructions.

The channel-independent rule

One rule covers every row. Never authenticate a financial request using the same communication thread it arrived in. Replying to the email, calling the number in the signature, or confirming in the same chat only asks the attacker to vouch for himself.

Use contact details from the vendor master record, the corporate directory, or the HR system instead. Require independent approval for high-risk changes even when the requester sounds like the CFO, because the process anomaly is the signal, not the quality of the prose.

A familiar voice establishes context. It doesn't establish identity, and it never authorizes a payment on its own.

Give staff this list, but don't stop at recognition. The signal only tells them when to act. Business email compromise training has to rehearse the verification step until making that callback feels routine, not confrontational.

I would also make one protection explicit. An employee who pauses a legitimate payment to verify it has followed the process correctly and shouldn't be penalized for the delay.

How to Design Phishing Simulations That Teach Judgment

Many teams send the same easy template every month, watch the click rate fall, and report success. Staff haven't learned judgment. They've learned to recognize your test. Real BEC messages vary by mechanism, context, and difficulty, so your simulations need to vary too, in a controlled way. If you're weighing the evidence first, our review of whether phishing simulations work sets out where they help and where they don't.

Five steps that separate difficulty from performance

1. Classify by mechanism. Label every scenario before launch as invoice diversion, executive impersonation, payroll change, supplier-account compromise, or urgent wire request. This stops you averaging unlike risks into one meaningless score and lets Finance see which workflow breaks.

2. Score difficulty before launch. The NIST Phish Scale user guide provides a step-by-step process for rating how difficult a simulated phishing email is for humans to detect, using email properties and research-based criteria. Rate the message first, then judge the employee against that rating.

3. Set a comparable baseline. Establish your starting point at a defined difficulty level for each role group. Don't compare an easy baseline email with a difficult follow-up and interpret a higher failure rate as deterioration, because you've changed the test, not necessarily the behavior.

4. Coach immediately and specifically. Feedback should land while the decision is fresh, name the signal missed, and show the verification step that would've stopped it. After a failed attempt, we provide follow-up training as remediation, not a generic module or a manager notification designed to shame.

5. Repeat longitudinally and track behavior. Run campaigns over time and record reporting, credential submission, payment-request escalation, and time-to-report. Retest coached staff with a different scenario after a defined interval, so you're checking transfer of the rule rather than memory of the template.

What counts as passing

For BEC, a pass isn't avoiding a click. Many of these attacks contain nothing to click. A pass means the employee verified through an independent channel, reported the message, and took no unauthorized financial action. Someone who ignores a fraudulent invoice without reporting it hasn't failed outright, but they haven't given your team the signal it needs either.

Design check: If your simulation can be passed by doing nothing, it isn't testing the behavior that prevents a fraudulent transfer.

Keep coaching records at the individual level for follow-up, but report trends by role and mechanism to leadership. Public rankings teach people to hide mistakes, and hidden mistakes are exactly what an attacker needs during a live incident.

One more trade-off to accept early. Realistic scenarios built with Finance take longer to write than vendor templates, and they need approval from someone who owns the workflow. That effort is the point. A generic parcel-delivery lure tells you almost nothing about whether accounts payable will hold a supplier payment.

Scenario Lessons for Payment and Approval Decisions

Two days before a large payment run, a supplier emails new bank details. The sender's name is right, the invoice references a real delivery, and procurement is pressing for release because the goods have arrived. The learner answers four questions in order.

What changed? A beneficiary account, which makes this a high-risk verification event regardless of who sent it. Who do I call? The supplier contact already in the vendor record, using a number stored before this request arrived. When do I pause? Immediately. Hold the payment until confirmation comes back through that known contact. What do I document? Who confirmed, when, through which number, and who gave second approval to update the record.

Two more decision points worth rehearsing

A CFO's assistant receives a wire request from a phone number that matches the CFO but is not saved in contacts, with a note that she is in a meeting and cannot talk. Route the request through the normal approval system and confirm through the CFO's known number or the established assistant workflow. The refusal of the shortcut is the control working. I would rather hold a legitimate payment than treat urgency from an unsaved number as approval.

An accounts payable clerk is asked to pay an invoice for a vendor whose tax ID has changed. That detail suggests the legal entity may have changed too, so the clerk should match invoice, purchase order, and vendor record, then escalate the mismatch to procurement before paying. Teams reviewing their wider AP process can compare control effort against outcomes using Loopfour's AP automation before-and-after metrics, a useful prompt for deciding which checks to systematize and which to keep as human verification.

Role variants and new hires

Give executive assistants authority-based requests with secrecy pressure, accounts payable altered invoices, procurement supplier onboarding changes, and IT fake password-reset or access requests tied to a finance system. Each variant ends in the same place: pause, verify independently, escalate, document.

Put these lessons in onboarding rather than waiting for an annual refresher. New hires tend to be more susceptible to phishing than tenured staff. New starters do not yet know a supplier's normal language or your approval chain, so they need the script before they need the intuition.

Score the process, not the guess. If the request turns out legitimate and the learner still paused and verified, that is a correct answer, because the next identical request might not be legitimate. A completion certificate does not stop a wire. The pass is the callback, the hold, and the escalation, recorded by the person who owns that step.

Incident Reporting Workflow From Report to Recovery

At 4:12 p.m. an accounts payable clerk gets a supplier email changing the bank account on an invoice due tomorrow. The clerk uses /vigil report, then stops the payment. That sequence, report then freeze, is the control you are rehearsing. A polished investigation that starts the next morning does not recover a wire that already left.

In the FBI's 2024 IC3 report, BEC generated 21,442 complaints and approximately $2,770,151,146 in reported losses. Many targeted employees never report the message, and most who are fooled act within minutes. Attackers move on that clock, so the report path has to be short, named, and practiced before anyone is under pressure to pay.

The workflow to drill

1. Report through one channel. Employees flag the message with /vigil report. The same Slack commands cover the rest of training: /vigil learn starts the next assigned lesson, and /vigil progress shows personal progress. Give finance one route. A choice of inboxes delays the freeze.
2. Triage within one hour in business hours. A named on-call owner checks related messages, mailbox rules, and sign-in activity, then decides whether Finance needs to freeze anything.
3. Contact the sending bank immediately if money moved. Request a recall or hold with the amount, time, beneficiary, and transaction references ready. Do not wait for internal certainty.
4. Freeze related changes. Hold pending payments and account-change requests connected to the affected supplier, employee, or mailbox until verification is complete.
5. Preserve evidence. Keep original headers, message IDs, attachments, call logs, and approval records. Tell staff not to delete the message or forward it around the office.
6. File and notify. Submit a complaint through the FBI's IC3 and inform the finance lead and legal counsel, who can assess insurance notification and any duty to warn affected partners.
7. Close the loop with the reporter. Tell them what you found and thank them. Silence teaches people that reporting is not worth the effort.

If someone has already interacted with a message, the guidance on what to do if you clicked a phishing link covers the immediate containment steps for that person while triage runs.

Test it before you need it

Run a quarterly tabletop with the reporter, the triage owner, Finance, and whoever holds the bank's fraud-team number. Time the first step. If locating the bank contact takes twenty minutes in a calm drill, it will take longer during a live loss. Fix the contact list before writing more policy.

I would score the drill on whether the payment was verified and the change was escalated, not on whether anyone spotted the email. Record report time and triage time for every real and simulated incident. Those two clocks show whether the reporting workflow produces a usable warning while the money can still be stopped.

Measuring Whether BEC Training Changes Behavior

Completion certificates don't stop wire fraud, and the evidence for treating them cautiously is direct. An eight-month randomized controlled study of more than 19,500 employees and ten simulated phishing campaigns found no significant relationship between recent annual cybersecurity-training completion and the likelihood of failing a simulation, and only a very small absolute difference for embedded training.

Metrics that reflect decisions

Segment everything by role and payment authority. A companywide average can hide an accounts payable team that never verifies, behind hundreds of staff who can't move money anyway. Read a falling click rate only alongside a rising report rate, because people may be ignoring messages rather than escalating them.

Operational tracking still has its place. Our admins can see completion, comprehension, and overdue training at a glance and nudge one person or a whole channel, and administrators can access learner assignments, attempts, scores, and completion records. Use those records to find who needs coaching, not as proof that behavior changed.

Set a steady cadence. Review an operational dashboard monthly, sit down with Finance quarterly to examine verification and repeat failures, and give executives an annual summary tied to workflows and losses avoided rather than course percentages.

Start with One Payment Workflow This Quarter

Don't launch companywide. Pick the workflow with the highest exposure, which for most organizations is supplier bank-detail changes in accounts payable, and enroll the 10 to 20 people who process or approve them.

Run a six-week pilot in sequence. Write the verification standard in week one, then build one role-specific scenario, then run a difficulty-rated baseline. Teach a single rule until it's automatic: confirm every bank-detail change through the supplier's existing contact record, never a number supplied in the request, and hold the payment until confirmation arrives.

Record verified payment changes and median time to report from day one, before any training runs, so the pilot has an honest baseline. Review at week six. If verified changes rise and time to report falls, add the next workflow, such as payroll redirects, and repeat. If they don't, adjust the scenario and the escalation path, then rerun the pilot instead of scaling a weak design.

If your finance staff already work in Slack, running the pilot there avoids a separate portal and password during the fragile first weeks. I would keep the scope narrow until one team can show the behavior working under a real payment deadline.

---

Vigil Security delivers short, interactive business email compromise training and phishing coaching inside Slack, with role-based scenarios built around supplier bank changes, executive requests, and payment verification, plus reporting that shows attempts and comprehension rather than completion alone. If you'd like to run a focused pilot with your accounts payable team this quarter, visit Vigil Security to see how the lessons, reminders, and audit-ready records fit your workflow.