Business email compromise comparison: what to keep and what to drop

Every defense against payment fraud sits somewhere on a line from "before the money moves" to "after it has gone". The further right it sits, the less it is worth, and the more it costs to operate. That is the comparison worth making, and it is not the one most buying conversations have.

What follows compares the controls on four axes: what each one stops, how it fails, what it costs in friction, and whether it still works when a real supplier's real mailbox is under someone else's control.

What to take away

The controls, side by side

Read the last column first

The bottom row of most vendor comparisons is the top row of this one. When a genuine supplier's mailbox is under someone else's control, the message is authentic, the thread is real, the invoice is real, and every check based on inspecting the message returns a clean result.

That single case eliminates about half the controls above as defenses, while leaving them useful for other purposes. It also explains why a business that has bought well can still lose money, and why the boring, unfashionable process controls keep their value.

If you compare nothing else, compare on that column. It is the case that costs the most and the one most likely to reach a careful team, and the reasoning behind it is set out in business email compromise.

Friction is the axis nobody scores

A control that people avoid is not in place, whatever the policy says. Score friction honestly.

Voice verification costs a phone call per payee change and per new payee. That is genuinely small. Its reputation for being onerous comes from teams that applied it to every payment rather than to changes and first payments.

Two approvers cost a delay and, in a small team, an interruption to one specific person. That is manageable if the threshold is set where it belongs. It is unmanageable if it is set so low that everything requires it, at which point approval becomes a reflex and the control has quietly stopped existing.

Filtering costs false positives, and those land on the people least able to resolve them. A held customer order is a real business cost that rarely appears in the comparison.

Marking and alerting cost attention, which is the scarcest resource in a small business. Every additional banner and alert reduces the weight of all the others.

The rule of thumb is unglamorous: fewer controls, performed every time, beat more controls performed when convenient. The same logic drives the operating checks in security foundations controls.

Before against after

Split your list in two and look at the balance.

Before the payment: verification, approvals, role separation, fixed details, thresholds, and anything your bank offers on outgoing payments. These prevent the loss.

After the payment: reconciliation, statement checks, and the recall and reporting sequence. These reduce the loss and shorten the time to discovery, which is worth real money, but they are working with what is left.

Most small firms have a reasonable set on the left and nothing deliberate on the right, then discover the redirection when a supplier chases an invoice months later. Adding one thing on the right, a routine check of supplier statements against what you paid, is usually the highest-value gap to close, and it costs an hour a month.

Comparing detection channels by how late they fire

It is also worth comparing where you would find out, because the ranking is uncomfortable.

The filter fires before delivery, seeing the least. Mailbox alerting fires within hours of a takeover, covering only your own accounts.

The finance process fires at the moment of the request, the ideal point. Reconciliation fires in weeks; a supplier chasing an unpaid invoice fires in months, and by then the account the money went to is empty.

Anything that improves how early you find out is worth more than anything that improves what you find out. The United States National Institute of Standards and Technology orders its computer security incident handling guide phases the same way.

A migration is the one period when several channels degrade at once. That is why the sequencing in business email compromise migration matters more than it looks.

Common questions

If we can only do three things, which three?

Voice verification on a held number for payee changes and first payments. Strong authentication on finance and administrator accounts. Alerting on new mailbox rules and forwarding, delivered to a named person. Everything else is an improvement on that base rather than a substitute for it.

The second of the three is the one most often already paid for, and the United States Cybersecurity and Infrastructure Security Agency's multi-factor authentication guidance is a short way to decide which method to enroll people in.

Is a filtering product worth buying at all?

Yes, for volume and for the crude cases, and no, as a defense against the expensive one. Buy it knowing which column it occupies. What to require of it is set out in best business email compromise software 2027.

How do we compare two payment approval designs?

Test them against one written scenario: an urgent change of bank details from a real supplier, arriving on a Friday afternoon, while the person who normally approves is unreachable. Whichever design still produces a held payment is the better one, regardless of how it looks on paper.

Does insurance change the comparison?

It changes the consequence, not the control, and cover for funds transferred by a deceived employee is often handled separately from other losses. Read your own policy wording and ask your broker what it requires of your process, because the answer is specific to the policy rather than general. Staff-facing habits are covered in security compliance training.