AegisAI Perspectives · 122
Detect each business email compromise type by one signal: CEO fraud, vendor fraud, payroll diversion, attorney impersonation and gift cards, per the FBI.
See it on your own Google Workspace or Microsoft 365 tenant. No MX change.
Or get the Q3 2026 State of the AI Attack report (free, instant download)
Not ready for a demo? Check your domain (free, about 10 seconds).
Business email compromise has five types (CEO fraud, vendor fraud, payroll diversion, attorney impersonation, gift card scams), and each is caught by one signal: wrong sender, new bank account, hidden mailbox rule, secrecy, or bulk gift cards6. At AegisAI, AI agents check every payment request against the sender’s history, and stop the business email compromise that authentication lets through22. The FBI's IC3 recorded $3,046,598,558 in business email compromise losses for 20251.
The FBI's alert of 4 May 2017 covers three types (CEO fraud, vendor fraud, attorney impersonation), and FBI alerts of 18 September 2018 and 24 October 2018 cover payroll diversion and gift cards.
The 4 May 2017 alert says the executive wire scenario has been referred to as "CEO Fraud," "Business Executive Scam," "Masquerading," and "Financial Industry Wire Frauds".
In vendor fraud, a business with a longstanding supplier is asked to wire an invoice payment to an alternate, fraudulent account7.
In attorney impersonation, fraudsters identify themselves as lawyers or representatives of law firms and claim to handle confidential or time-sensitive matters8.
In payroll diversion, the criminal adds rules to the employee's account so the employee gets no alerts about direct deposit changes13.
In gift card scams, a spoofed email, call or text from a person in authority asks the victim to buy multiple gift cards16.
Assign each of the five types to the team that receives it: accounts payable, payroll, legal or the executive office.
Short on time? Watch the explainer, or book a demo.
In CEO fraud, a wire request from the executive's compromised account goes to a second employee who usually processes these requests5. The FBI's 2025 IC3 report warns that chat generators can quickly create official-sounding emails mimicking a company's CEO3, and businesses reported losses over $30 million to BEC scams involving AI in 20252.
Detect it by the sender address: the IC3 tells staff to verify that the address matches who the email claims to come from, especially on a mobile or handheld device20. When the executive's real account is hacked the address matches, so confirm every executive wire request through a secondary channel or two-factor authentication21.
The FBI's alert of 24 March 2023 says criminals impersonate the email domains of real U.S. companies with spoofed domains, such as @co-pany.com for @company.com, and the display names of current or former employees19.
Detect it by the change in payment location, which the 4 May 2017 alert says to verify with a secondary sign-off by company staff12. The same alert says to create intrusion detection system rules that flag email addresses similar to your company's own11.
Require that secondary sign-off on every change to a vendor's bank details before the next payment run.
The FBI's alert of 18 September 2018 describes criminals who obtain employee credentials, change the direct deposit details and add mailbox rules that hide the change alerts.
Detect it by a new mailbox rule on the account that asked payroll for a deposit change. The same alert tells employers to apply heightened scrutiny to employee requests to change direct deposit details15 and to monitor logins outside normal business hours14.
Open the mailbox rules of any account that asks payroll to change its deposit details before the change is processed.
The 4 May 2017 alert says victims may be pressured to act quickly or secretly in handling the transfer of funds9. This type may arrive at the end of the business day or week, timed to the close of international financial institutions10.
Detect it by the demand for secrecy or speed, and hold the transfer until a second person confirms it through a secondary channel.
The FBI's alert of 24 October 2018 counted 1,164 complaints filed with IC3 between 1 January 2017 and 31 August 2018, with an adjusted loss of $1,021,91917.
Detect it by a request from a person in authority to buy multiple gift cards, whether it comes by email, phone call or text. Confirm it by phone on a previously known number, not the number given in the email18.
Run these seven checks whenever an email asks for a wire, a deposit change or gift cards.
Read the full sender address on any executive or legal request, especially on a phone.
Flag sender domains close to your own company's or a vendor's, such as @co-pany.com for @company.com.
Require a secondary sign-off on any change in vendor payment location.
Apply heightened scrutiny to direct deposit changes and review new mailbox rules on the requesting account.
Check the requesting account for logins outside normal business hours.
Hold any transfer the sender asks you to handle quickly or secretly.
Call back on a number you already hold, never one from the email.
| BEC type (FBI alert date) | Signal to check | Manual check | AegisAI |
|---|---|---|---|
| CEO fraud (4 May 2017) | Executive wire request sent to the person who pays | Full sender address, then a second channel | Reads the request against what this sender has sent before23 |
| Vendor fraud (4 May 2017) | Invoice payment to an alternate account | Secondary sign-off on the change | Checks every payment request against the sender's history |
| Payroll diversion (18 Sep 2018) | Rule hiding direct deposit alerts | Review mailbox rules and odd-hour logins | Lists an "employee" changing direct deposit as payment fraud it reads24 |
| Attorney impersonation (4 May 2017) | Pressure to act quickly or secretly | Second person confirms the transfer | The verdict rests on the request itself |
| Gift cards (24 Oct 2018) | Request for multiple gift cards | Call back on a known number | No edge. Requests also arrive by spoofed call or text, which no email tool reads |
The manual check wins the gift card row, because a spoofed phone call or text never passes through an email tool. For BEC messages with no link or attachment, read which email security catches BEC with no link or attachment. Score your own controls against all five rows before your next payment run.
AI agents check every payment request against the sender’s history, and stop the business email compromise that authentication lets through. The verdict rests on what this sender has sent you before and on the request itself. Every verdict arrives with the evidence, so an analyst can confirm it in seconds4. The median verdict takes 1.9 seconds, then the email is removed from every mailbox that received it25.
Illustrative example, figures are fictional: At Harlow Freight (fictional, 600 mailboxes), the payment clerk reads the full sender address on Monday's $48,000 wire request in the CEO's name, finds a lookalike domain and stops the wire. On Tuesday the controller's sign-off call to a supplier shows that the new bank details on an invoice are false. On Wednesday the helpdesk finds a mailbox rule hiding deposit alerts on a warehouse lead's account, which logged in at 02:00. On Thursday the CFO holds a confidential transfer that "outside counsel" wants before Friday's close until a second person confirms it. On Friday the office manager calls her manager on the directory number before buying ten gift cards, and the request turns out to be false.
Run your own team through the same five days as a tabletop exercise this month.
Compare the three counts on day 30 with day 1, and add a check to any type with no reports. For the wider control set, read how to stop business email compromise.
The FBI's alert of 4 May 2017 covers three types (CEO fraud, vendor fraud, attorney impersonation), payroll diversion has its own alert of 18 September 2018, and gift card scams have an alert of 24 October 2018.
Choose on criteria, not brand: the tool should read the request and the sender's history, because a hijacked account can pass authentication. Test it on the five signals in the comparison table, including gift cards, where requests also arrive by spoofed call or text.
Pick a tool that reads an executive's wire request against what that sender has sent before, and pair it with mailbox rule reviews, because payroll diversion hides deposit alerts with rules. Read the detail in stopping CEO fraud and payroll diversion.
Combine a mail tool that checks every payment request against the sender's history with a finance rule: a secondary sign-off on any change in vendor payment location. Confirm each change through a secondary channel on a number you already hold.
One that reads the request itself: vendor fraud asks to pay a real invoice into an alternate account with nothing to scan, so the verdict has to rest on the sender's past mail and the request.
Pick a tool that checks every payment request against the sender's history, because the FBI's 2025 report warns that chat generators can mimic a CEO's emails. Ask that every verdict arrive with its evidence, so an analyst can confirm it in seconds.
