AegisAI Perspectives · 096
After an invoice scam, recall the payment through your bank first, then pick BEC protection that checks each payment request against the sender's history.
See it on your own Google Workspace or Microsoft 365 tenant. No MX change.
Or get the Q3 2026 State of the AI Attack report (free, instant download)
Ask your bank for a recall first, then choose BEC protection that judges each payment request against the sender's history and shows its evidence. The FBI's Financial Fraud Kill Chain reported a 58% success rate in 202511. AegisAI bases each verdict on what the sender has sent you before and on the request itself15. Use the 30-day order below, then hold every candidate tool to the six requirements in the table.
Call your bank before you call any vendor. The FBI tells victims to contact the originating financial institution as soon as fraud is recognized and request a recall or reversal, plus a Hold Harmless Letter or Letter of Indemnity1.
Then file a complaint at ic3.gov. The FBI says it is vital the complaint contains all required data in the fields provided, including banking information3. In 2025 the IC3 Recovery Asset Team handled 3,900 Kill Chain incidents with $1,163,919,846 in attempted theft and froze $679,013,183.
IC3 recorded 24,768 business email compromise complaints in 20259, and BEC losses rose to $3,046,598,558 from $2,770,151,146 in 2024. The full bank-side sequence is in what a bank should do in the first hours of a BEC wire.
Make the bank call and the IC3 complaint on day 0, and leave the tool search for week 3.
Short on time? Watch the explainer, or book a demo.
Work the month in this order, one owner per step.
Call the originating bank, ask for a recall or reversal and a Hold Harmless Letter or Letter of Indemnity.
Enter every required field, including the banking information of the fraudulent account.
Export the scam thread with full headers. Check every mailbox in the payment chain for forwarding rules and sign-ins you did not expect, before anyone cleans up.
Enforce dual approval for vendor updates7, and set a mandatory cooling-off period before a change takes effect.
Confirm each active supplier's account through a second channel you already hold. In the U.S. Bank sample case, the company had no out-of-band verification for vendor banking changes.
Use the six rows in the table below as the scoring sheet for every candidate.
Connect the candidate through the Microsoft Graph API, which some services use to scan messages after delivery to user mailboxes12. Compare its flags with the accounts payable change log.
Pin this list to the incident ticket and tick each step with a date.
The next tool should compare each payment or bank change request with what that sender has sent you before. In the U.S. Bank sample case, the gap was a vendor banking change with no out-of-band check. Ask every candidate three things about it: what history it reads, what it reads in the request, and where it looks for the reply address.
The second requirement is evidence. A verdict with no reasons leaves accounts payable guessing at the moment a payment is due. Ask each candidate to show, on a real message, the lines of evidence an analyst would read before releasing or removing it.
The third requirement is reach after delivery. A scam email that has already landed in five inboxes needs to come out of all five. Ask how a flagged message is removed from every mailbox that received it.
Put these three questions to every candidate in writing before the trial starts.
Score each candidate against these rows, and keep the two rows no email tool can fill.
| Requirement | What to ask any candidate | AegisAI |
|---|---|---|
| Reads sender history | Does it compare a bank change request with what this sender sent before? | Yes. The verdict rests on the sender's history and the request |
| Shows its evidence | Can an analyst confirm a verdict without a second tool? | Yes. Every verdict arrives with the evidence |
| Removes after delivery | Can one bad email leave every mailbox that received it? | Yes. Removal from every mailbox follows the verdict |
| Starts without mail flow changes | Can it start on live mail without changing mail flow? | Yes. Monitoring mode on live mail with no MX change |
| Payment approval controls | Who approves a vendor bank change, and after what delay? | No edge. Dual approval and cooling-off periods sit in finance, outside any email tool |
| Recovering money already sent | Who can recall or freeze the payment? | No edge. Recall and freezes run through the banks and the IC3 Recovery Asset Team |
60-second self-check
Six questions. Nothing is sent anywhere; the result shows on this page.
The longer criteria list, with vendor email compromise cases, is in how to choose BEC and vendor email compromise protection. See the six requirements run on your own tenant through the demo page.
AegisAI reads a payment thread the way an analyst would: the sender's history, the change being asked for, and where the reply actually goes13. Every verdict arrives with the evidence, so an analyst can confirm it in seconds. The median verdict takes 1.9 seconds, then the email is removed from every mailbox that received it. Run it in monitoring mode on live mail with no MX change, then turn on removal.
Payment controls sit outside email security, and the U.S. Bank sample case shows why. It had no out-of-band verification for vendor banking changes. Its fixes are process rules: dual approval for vendor updates and a mandatory cooling-off period before changes take effect.
An email tool flags the request. The approval rule stops the payment when a request slips through. Keep both, because each covers the failure of the other.
Write the dual approval rule and the cooling-off period into the accounts payable policy this week.
Illustrative example, figures are fictional. Harbor Lane Foods (fictional) pays $96,400 to a new account after an email in a real supplier thread asks for updated bank details. On day 0 at 11:20 the real supplier asks why it has not been paid. By 12:05 the controller has called the bank for a recall and a Hold Harmless Letter, and by 13:30 the IC3 complaint is filed with the fraudulent account details. On day 2 the email admin finds an unknown forwarding rule on the accounts payable mailbox and exports the thread. In week 1 finance adds dual approval and a 3-day cooling-off period for bank changes. In week 2 accounts payable calls 41 suppliers on numbers from the vendor file. In week 4 the shortlisted tool runs in monitoring mode and flags 2 bank change requests; both show the sender history behind the flag.
Copy this timeline into your own incident ticket and replace the figures with yours.
Track three numbers, each from a system you already have.
Review the three numbers with finance and IT on day 30, and buy only if the third one holds up.
Choose protection that compares each payment or bank change request with the sender's history, shows its evidence and removes a flagged email from every mailbox. Add dual approval and a cooling-off period for vendor bank changes. Recall the money through your bank first.
Sometimes. A fast recall request may reduce or eliminate the loss, according to the FBI. Victims should contact the originating bank as soon as fraud is recognized and request a recall. In 2025 the IC3 Recovery Asset Team froze $679,013,183 across 3,900 Kill Chain incidents, a 58% success rate.
Every required field, including the banking information for the payment. Add the date and amount of the transfer, the receiving account and the scam email with headers. In 2025 the IC3 Recovery Asset Team handled 3,900 Financial Fraud Kill Chain incidents.
Not always. Some services authenticate to the Microsoft Graph API and scan messages after they are delivered to user mailboxes. Ask whether the tool can run in monitoring mode on live mail before it removes anything.
It can when it reads the request against that sender's history, because the sending address is genuine in that case. Keep the payment controls as well: dual approval for vendor updates and a cooling-off period before changes take effect.
After the recall, the IC3 complaint and the evidence work are done. Run the candidate in monitoring mode on live mail in week 4, and decide with the flag log in hand.
