AegisAI Perspectives · 063
Choose BEC and vendor fraud protection by how it judges a real supplier's bank change, spots look-alike domains and shows finance why before money moves.
Choose BEC protection by what it does when a real supplier asks to change bank details. BEC losses reported to the FBI reached $3,046,598,558 in 20256. The tests below hold on any mail platform. A hijacked supplier mailbox signs as itself, so SPF, DKIM and DMARC pass1. AegisAI judges the request against what that sender has sent before.
Start with the hardest case: SPF, DKIM and DMARC pass, and there is no link or malware to find. The FBI describes BEC as a scam often carried out after a criminal compromises a legitimate business email account, then uses it to make unauthorized fund transfers11. The reply arrives inside a real invoice thread, from an address you have paid for years. Email authentication is built to stop forged senders24, and this sender is not forged.
So the tool has to read something other than the sender's credentials. Ask what it compares the message with: the supplier's past invoices, the usual signer, the usual bank, the usual tone of a payment request. The page on how attackers carry out vendor email compromise walks through the full chain.
Question to ask a vendor: when a supplier we have paid for years asks to change bank details from its own mailbox, what does your product compare that request with?
The second route uses a domain the attacker owns. In a related vendor fraud scheme, criminals use spoofed domains and the names of real or invented employees, and the FBI lists look-alike domains next to the legitimate ones12. An attacker can register a domain, set up SPF or DKIM for it, and send mail that passes authentication25. A passing result proves only that the attacker controls the domain.
The FBI's own advice is to confirm that the email domain matches the company it claims to represent14. A tool should do that check on every supplier reply, including a reply-to address that quietly points somewhere new.
Question to ask a vendor: do you flag a reply from a newly seen domain that differs from the supplier's usual domain by one word or one letter?
A bank change is the action vendor email compromise exists to cause. The FBI advises verifying requests to change account information through a secondary channel or two-factor authentication9. It also advises calling the business's main phone line directly, not a number given in the email13.
A flag on the right message, in front of the person who approves the payment, is what makes that call happen.
Question to ask a vendor: when a message asks to change where money goes, who sees the flag, and does it reach accounts payable before the next payment run?
Forwarding rules let an attacker read a mailbox quietly while the fraud runs. In Microsoft 365, Inbox rules can forward mail to external senders, by choice or as a result of a compromised account15. Microsoft lists rules that forward to unknown addresses, and recently added external forwarding, among the symptoms of a compromised mailbox17. In Google Workspace, user auto-forwarding is on by default19.
In Microsoft 365, setting automatic forwarding to Off in the outbound spam filter policy disables Inbox rules and mailbox forwarding to external addresses16. In Google Workspace, admins can turn auto-forwarding off or limit it to internal addresses21. The switch sits in the Admin console under Apps, Google Workspace, Gmail, End User Access, Automatic forwarding20. The platform pages go deeper: how to choose BEC protection for Microsoft 365 and how to protect Google Workspace from BEC.
Question to ask a vendor: do you alert on a new forwarding rule in our own mailboxes, on each mail platform we run?
A verdict on a supplier email is only useful if the person who pays the invoice can read it. Ask to see the reason in plain words: a first bank change in a long thread, a reply that goes to a new domain, a deadline on an open invoice. An analyst should confirm or clear it without opening a second tool.
Question to ask a vendor: show me the full verdict on one flagged bank change and one allowed one, from our own mail.
After a BEC incident, the FBI says to contact your bank as soon as fraud is recognized to request a recall, then file a complaint at ic3.gov10. In 2025 the IC3 Recovery Asset Team froze $679,013,183 across its Financial Fraud Kill Chain cases, a 58% success rate8.
So the tool should leave a record finance and the bank can use the same day: the message, the thread, the change requested and the time it was flagged.
Question to ask a vendor: can we export the full record of a flagged supplier email in a form our bank and the IC3 complaint can use?
The table sets four approaches side by side on the criteria above.
| Criterion | API-based | Gateway | Built-in platform controls | Managed service |
|---|---|---|---|---|
| Real supplier mailbox hijacked | Reads the thread and the sender's history after delivery | Filters each inbound message by its own rules before delivery | Authentication passes; email authentication targets forged senders | Depends on the tools the provider runs |
| Look-alike supplier domain | Compares the domain with the supplier's usual one | Checks domains in the mail path | Depends on edition and settings | Depends on the provider's review |
| Bank-detail change | Can flag the request inside the existing thread | Reads each message as it passes | None by itself; needs a call-back rule | Depends on the provider's review |
| Forwarding rules | Needs mailbox access through the platform API | Sees messages in transit only | Off switch in each platform's admin settings | Depends on the access you grant |
| Mail path | No MX change; removes mail from mailboxes | MX record change; mail passes through it | Inside the platform | Set by the tools the provider runs |
| More than one platform | One connection per tenant | One MX change per domain | Separate settings on each platform | Depends on the provider |
Answer each one with evidence from a trial on your own mail.
Does a bank change from a known supplier's real mailbox get its own check?
Does the tool compare the request with that supplier's past messages?
Does it flag a reply from a new domain that resembles a supplier's domain?
Does it flag a reply-to address that points away from the supplier's domain?
Does the flag reach accounts payable before the next payment run?
Do you call back every bank change on a number you already hold?
Is external auto-forwarding off, or limited to internal addresses, on every mail platform you run?
Does every verdict show the evidence an analyst needs to clear it?
Can you export a flagged message's full record for your bank?
Do you know the bank contact and IC3 steps if a payment has already gone?
Illustrative example, figures are fictional. A distributor pays 340 suppliers. A reply lands in a six-month invoice thread from a supplier's real mailbox: "our bank has changed, please use the new account for INV-5521 ($48,200) before Friday." Authentication passes. The tool flags it as the first bank change in 96 messages from that supplier, with replies routed to a domain registered nine days earlier. Accounts payable calls the supplier on the number in its vendor file. The supplier never sent it.
AegisAI reads the thread the way an analyst would: the sender's history, the change being asked for, and where the reply actually goes2. When a supplier's real account is compromised, authentication passes, so the verdict rests on what this sender has sent before and on the request itself. It connects by API and works after delivery; the median verdict takes 1.9 seconds, then the email is removed from every mailbox that received it. It covers Microsoft 365 and Google Workspace, takes about five minutes to connect, and shows results in five days on your own tenant.
Build it from three parts that check each other: the email tool, the mail platform settings and the payment process. The email tool flags the supplier request that does not fit the supplier's history. The platform settings close the quiet routes: external forwarding off in Microsoft 365 and limited or off in Google Workspace. The payment process verifies every change of account information through a second channel and calls the supplier on its main line.
Then write down the step for the day it fails. Contact the bank at once to request a recall, and file a complaint at ic3.gov. Give the accounts payable lead and the email admin the same written list, so neither waits for the other.
The FBI's 2025 figures are counts of complaints and losses: 24,768 BEC complaints in 20257, with $3,046,598,558 in reported losses. Exposure follows the payment process more than headcount. A company that pays hundreds of suppliers by email, with one person approving bank changes, carries more of this risk than its size suggests. Count your suppliers and the bank changes that arrived by email last quarter; that is your exposure.
Track three numbers from the first day.
The best one judges a supplier's request against that supplier's history, tells a hijacked thread from a look-alike domain, and shows accounts payable the reason before money moves. It should also watch forwarding rules on every platform you run. The FBI received 24,768 BEC complaints in 2025.
Vendor email compromise is BEC that runs through a supplier's mailbox, hijacked or imitated. BEC is often carried out after a criminal compromises a legitimate business email account, and a related FBI warning covers fraud through spoofed supplier domains. The page on how vendor email compromise works covers each step.
Not on their own. They are standards to stop forged senders. A hijacked supplier mailbox signs as itself and passes, and an attacker's own look-alike domain can pass too.
Call the supplier's main phone line directly, not a number given in the email. Verify any change of account information through a second channel before the next payment.
Contact your bank at once to request a recall, then file a complaint at ic3.gov. The IC3 Recovery Asset Team reported a 58% success rate on its 2025 cases.
The criteria stay the same; the settings differ. Microsoft 365 controls external forwarding in the outbound spam filter policy, and Google Workspace in the Gmail end user access settings. The two platform pages cover each one in detail.
