AegisAI Lab · Lab Note 006
Financial firms need DMARC at p=reject, MFA on every mailbox and a callback rule for emailed payment changes, mapped to FFIEC guidance and FinCEN advice.
Financial firms need DMARC at p=reject on every domain, MFA on every mailbox, and a callback rule for emailed payment changes. Business email compromise drew $3,046,598,558 in reported losses in 2025.
That figure comes from 24,768 complaints to the FBI's Internet Crime Complaint Center. In 2024 the count was 21,442 and the losses were $2,770,151,146.
Work through these in order. Steps 1 to 4 close the spoofing path. Steps 5 and 6 protect the mailbox. Steps 7 to 9 cover payments.
List every domain you own, including domains that never send mail. NIST SP 800-177 Rev. 1 groups SPF, DKIM and DMARC as sending-domain authentication. Publish SPF and DKIM for each sending domain, then DMARC at p=none with a rua address for reports.
Raise DMARC in stages. Microsoft Learn sets the path as p=none, then p=quarantine, then p=reject. Start with a low volume subdomain and leave the parent domain for last. Step pct through 10, 25, 50, 75 and 100 at each policy. Read the aggregate reports weekly during the rollout.
Lock parked domains. A domain that never sends mail gets the record v=DMARC1; p=reject;.
Enforce DMARC on inbound mail. In Microsoft 365, turn on Honor DMARC record policy in the anti-phishing policy. Mail that fails DMARC from a p=reject domain is then refused during SMTP.
Require MFA or an equivalent control on every mailbox. The FFIEC guidance says single-factor authentication, alone or with layered security, is inadequate in many situations. For email systems it lists secure configuration, MFA or equivalent access, plus continuing user education.
Block malicious mail and watch the mail system. The FFIEC appendix lists anti-phishing controls that block malicious messages and attachments, move malicious attachments to a segregated environment, and monitor email systems for suspicious activity. It also lists a prominent banner on external email.
Write the callback rule. FinCEN advises verifying emailed payment instructions through multiple channels or with authorized personnel before paying. Apply it to every change of beneficiary account that arrives by email.
Route red flags to the callback. FinCEN lists red flags. Three of them fit an email rule: a sender address closely resembling a known customer's, a request marked Urgent, and beneficiary details that differ from what was used before.
Prepare the failure path. If a wire goes out, contact the financial institution that sent it and request a recall. File at ic3.gov with full transaction details. FinCEN reports better recovery when BEC wires reach law enforcement within 24 hours.
Plan first for payment fraud by email. The FinCEN red flags describe it from the bank side: a sender address that nearly matches a customer's and an Urgent label, then a new beneficiary account. Some of these scams now involve AI: the IC3 counts over $30 million in 2025 losses to BEC scams involving AI.
The FBI also runs a process to freeze stolen funds. In 2025 the IC3 Recovery Asset Team ran the Financial Fraud Kill Chain on 3,900 incidents and froze $679,013,183, a 58% success rate. For how BEC requests are built and stopped, read how to prevent business email compromise.
No single rule is titled email security. The expectations sit in the FFIEC authentication guidance, the SEC's Regulation S-P amendments and FinCEN's BEC advisory. The table maps each control to its source.
| Control | Setting to show an examiner | Where the expectation comes from |
|---|---|---|
| Sending-domain authentication | SPF and DKIM on every sending domain, DMARC at p=reject | NIST SP 800-177 Rev. 1; Microsoft Learn rollout |
| Parked domains | v=DMARC1; p=reject; on domains that send no mail | Microsoft Learn |
| Inbound spoofing | Honor DMARC record policy turned on | Microsoft Learn |
| Mailbox access | MFA or equivalent on every mailbox | FFIEC authentication guidance |
| Malicious mail and attachments | Block, segregate attachments, monitor email systems | FFIEC appendix |
| External mail | Prominent banner on every external message | FFIEC appendix |
| Emailed payment changes | Second channel verification before paying | FinCEN advisory |
| Customer information incidents | Written incident response program; notice within 30 days | SEC Regulation S-P amendments |
| Service providers | Breach notice to you within 72 hours; due diligence and monitoring | SEC Regulation S-P amendments |
| BEC reporting | BEC FRAUD in the SAR narrative and field 31(z) | FinCEN advisory |
| User testing | Social engineering campaigns that test policy adherence | FFIEC appendix |
The SEC rows apply to five kinds of firm, including broker-dealers and registered investment advisers. Their customer notice deadline is as soon as practicable, and no later than 30 days after the firm learns of unauthorized access to customer information.
Illustrative example, figures are fictional. A credit union with 40,000 members gets an email from a vendor it pays monthly. The sender domain swaps one letter of the real one. The message is marked Urgent and gives a new beneficiary account for an invoice of $186,000. Three FinCEN red flags match. The callback rule sends the request to accounts payable, who call the vendor on the number from the last contract. The vendor sent nothing. No wire leaves. The analyst keeps the sender address with its IP address and timestamps, the details FinCEN asks for in a SAR. The SAR narrative carries the key term BEC FRAUD, also entered in field 31(z).
Had the wire gone out, the same file feeds the recall request and the IC3 complaint. The clock that matters is the 24 hours FinCEN names.
Test each layer with the evidence an examiner will ask for.
For the DMARC stages in more detail, read how to roll out DMARC from p=none to p=reject without breaking mail.
Track three numbers. Each one already sits in a system you run.
No rule covers email alone. The FFIEC authentication guidance lists email controls: MFA or equivalent access, secure configuration, anti-phishing, banners and monitoring. FinCEN's BEC advisory adds red flags plus payment verification. It also sets the SAR key terms.
None of the rules cited here names DMARC on its own. NIST SP 800-177 Rev. 1 groups SPF, DKIM and DMARC as sending-domain authentication. The FFIEC guidance expects secure configuration of email systems. DMARC at p=reject is the setting that shows both.
Request a recall of the funds. File at ic3.gov with full transaction details. FinCEN reports greater recovery success when BEC wires reach law enforcement within 24 hours. Then file a SAR with BEC FRAUD in the narrative and field 31(z).
Under the 2024 Regulation S-P amendments, covered institutions notify affected individuals as soon as practicable, and no later than 30 days after learning of unauthorized access to customer information. Broker-dealers and registered investment advisers are among the covered institutions.
A covered institution's procedures must require its service providers to report a breach as soon as possible, and no later than 72 hours after they become aware of it. The firm also needs written procedures for overseeing those providers through due diligence and monitoring.
FinCEN asks for the key term BEC FRAUD in the SAR narrative and in field 31(z) when a business is the victim. It also asks for the email addresses with their IP addresses and timestamps, plus the wire details and beneficiary information.
