AegisAI Perspectives · 104
Security teams stop CEO fraud and payroll diversion with two controls: an email layer that reads each request against sender history, and a verified call.
See it on your own Google Workspace or Microsoft 365 tenant. No MX change.
Or get the Q3 2026 State of the AI Attack report (free, instant download)
Security teams stop CEO fraud and payroll diversion with two controls together: an email layer that checks every payment request against the sender's history20, and a call to a known phone number before any bank detail changes7. The FBI's IC3 recorded $3,046,598,558 in business email compromise losses for 202516. AegisAI reads the sender's history and the change being asked for, plus where the reply actually goes21.
Security teams recommend out-of-band verification for any bank detail change, vendor onboarding, payment reroute or urgent exception13. The FBI's IC3 gives the same advice: verify any request to change account information with the intended recipient through a secondary channel or two-factor authentication7.
Read how universities stop payroll diversion and gift card scams for the version of this attack aimed at a public staff directory. Read how to protect against vendor email compromise for the supplier version, where the fake sender poses as a vendor.
Require phishing-resistant MFA on executive accounts first, then on finance, HR or IT admin accounts.
Short on time? Watch the explainer, or book a demo.
Spam and authentication checks miss CEO fraud when the attacker writes from a real mailbox, taken by phishing an employee for their login credentials6.
IC3's 2025 report shows the scale: businesses reported losses over $30 million to BEC scams involving AI17, and IC3 received more than 22,000 complaints reporting AI-related information.
Treat a pass on email authentication (SPF, DKIM, DMARC) as proof of the sending domain only, and judge the request on its own.
Give payroll clerks these six steps, each tied to an FBI or payroll security source.
For every request that changes bank details, payment routing or direct deposit, make no system update before out-of-band verification.
Call the person on a known phone number held in your own records.
Apply heightened scrutiny to any employee request to update or change direct deposit credentials, as the FBI advises4.
Verify the sender address, especially on a mobile or handheld device, and confirm it matches who the message claims to be from9.
Confirm account changes with the intended recipient through a secondary channel or two-factor authentication.
Monitor employee logins that occur outside normal business hours5.
Have the heads of HR and finance sign these six steps, then audit a sample of recent changes against them.
TechTarget's CISO guide to business email compromise lists the anomalies to watch: logins from unusual locations, off-hours wire requests and sudden changes to vendor details15. A mail tool separates a hijacked executive mailbox from the real person by reading four signals.
Ask every tool on your shortlist which of these four signals its verdict uses, and ask for one real verdict with its evidence.
Score each tool yes or no on the first five rows, and run the sixth row, a call to the number on file, as a payroll control your team owns.
| Criterion | Trial question | AegisAI |
|---|---|---|
| Reads sender history | Does it flag a request that breaks this sender's past pattern? | Yes: the verdict rests on what this sender has sent before and on the request |
| Handles a hijacked real account | Does it flag a compromised mailbox that passes authentication? | Yes: it targets the compromise that authentication lets through |
| Reads the reply path | Does it check where a reply would actually go? | Yes: it reads where the reply goes |
| Shows evidence | Can an analyst confirm the verdict from what is shown? | Yes: every verdict arrives with its evidence23 |
| Covers CEO and payroll requests | Does it flag a CEO-name wire request and a direct deposit change? | Yes: both cases are named on the product page |
| Call to a number on file | Who confirms the change by phone before payroll updates it? | No edge: a payroll process control your team runs |
60-second self-check
Six questions. Nothing is sent anywhere; the result shows on this page.
Use the demo request page to run these six trial questions on your own mail.
Drop any tool that cannot show you a verdict, with evidence, on a request from an authenticated mailbox.
Replay fake executive and payroll requests against live mail, with the tool set to flag only, and keep the call-back rule running throughout.
Illustrative example, figures are fictional. A 900-person firm replays 12 test messages over 30 days. Four of the 12 come from a test mailbox that passes every authentication check. Tool A flags 12 of 12 and shows its evidence for each. Tool B flags 8 and misses all four from the authenticated mailbox. The firm picks Tool A and keeps the call-back rule for every change.
Write the pass mark down before the trial starts: every replayed request flagged with its evidence, whether the sender was spoofed or authenticated.
Call the bank first: the FBI tells victims to contact the originating financial institution as soon as fraud is recognised, to request a recall or reversal and a Hold Harmless Letter or Letter of Indemnity8. An employee whose pay was diverted contacts their own bank to request a recall, and reports the irregular deposits to the employer11.
Then file a complaint with IC3, whatever the amount; BEC victims use BEC.IC3.gov10.
Put the bank's fraud line and the IC3 complaint link in the payroll runbook today.
AegisAI reads the thread the way an analyst would: the sender's history, the change being asked for, and where the reply actually goes. The verdict rests on what this sender has sent you before and on the request itself. AI agents check every payment request against the sender's history, and stop the business email compromise that authentication lets through. Every verdict arrives with the evidence, so an analyst can confirm it in seconds.
Track three numbers, each from a system you already run:
Review all three with HR and finance at day 30, and fix any change that went through without a logged call.
An email layer that checks every payment request against the sender's history, plus a call to a known phone number before any bank detail changes. Add phishing-resistant MFA, starting with executives and with finance or HR staff.
No: authentication lets through the business email compromise sent from a real, hijacked mailbox. Attackers get that access by phishing employees for their login credentials.
Call the employee on a known phone number held in your own records. Make no system update before that check.
In one case a bank describes, three weeks passed before the real employee noticed the pay was not arriving.
Contact the financial institution at once to request a recall of funds, and report the irregular deposits to the employer. File a complaint with IC3 regardless of the amount.
IC3's 2025 report lists business email compromise losses of $3,046,598,558 for the year. Businesses separately reported losses over $30 million to BEC scams involving AI.
