· cyber security · 5 min read
Business Email Compromise and the Call-Back Rule
Fake vendor invoices and payroll direct-deposit changes work because they look routine. A call-back rule and a few inbox alerts make them harder to pull off, and co-managed IT decides who watches for the warning signs.
Business email compromise (BEC) is fraud by email, aimed at moving money. It needs no malware. Someone asks, and someone in your office says yes.
Picture a 120-person engineering firm. An email arrives from a subcontractor’s billing contact saying their bank account has changed, so please use the new details on the attached invoice. The next payment goes to a stranger.
Payroll has its own version. At a contact center with agents in several countries, an email that appears to come from an employee asks HR to switch direct deposit to a new account. The first paycheck after that goes where the fraudster chose.
How the fraud actually works
Sometimes the attacker registers a look-alike domain with one letter changed and hopes nobody checks. That version is easier to spot.
The harder version starts with a real compromised mailbox, either yours or your vendor’s. The attacker reads the existing threads, learns how invoices are discussed, and replies inside a real conversation. The message sounds right because it is sitting in the right thread.
After getting in, attackers often create inbox rules. One rule forwards copies of mail to an outside address. Another moves any message containing words like “invoice” or “payment” into an obscure folder, so the real person never sees the replies. The mailbox owner can work normally for weeks while someone else reads along.
The call-back rule
The rule is simple. Any request to change bank details, payment instructions, or direct deposit is verified by phone, using a number you already had on file.
That number comes from your own records: the contract, the last known good invoice, the employee file. A number in the email or its signature may belong to the attacker.
A few details make the rule hold up:
- A second person approves any change to payment details.
- The rule applies to requests that appear to come from a founder, partner, or executive, because those are the ones people hesitate to question.
- Urgency does not waive the rule. Urgency is what the fraudster is counting on.
- The caller writes down who they spoke to and when.
Put the rule in writing and tell the staff who handle accounts payable and payroll. Those two roles carry most of the exposure.
Technical controls that back it up
The call-back rule catches the request. These controls make it harder for an attacker to get into a mailbox in the first place, and they raise a flag when one gets in.
- MFA (multifactor authentication) on every mailbox, with no exceptions for executives or shared accounts. An authenticator app or passkey is better than a text message code.
- An alert whenever someone creates an inbox rule that forwards mail outside the organization or moves mail to an unusual folder.
- Automatic forwarding to outside addresses switched off, unless there is a documented reason to allow it.
- Impossible-travel alerts. A sign-in from Oklahoma City, then another from a different country twenty minutes later, cannot both be the same person. Remote and traveling staff will trigger some false alarms, so tune the alert with what your IT manager knows about who is where.
- Audit logging turned on and kept long enough to look back through. If you find a bad rule, you will want to know what it did since the day it was created.
Microsoft 365 supports all of these. They take setup and someone paying attention, and the second part is the one that gets skipped.
Who watches for suspicious inbox rules in co-managed IT
An alert nobody reads protects nothing. Decide before the alert fires who sees it and who acts.
In most co-managed IT setups, the MSP does the watching. We monitor Microsoft 365 sign-ins and new inbox forwarding rules, investigate what fires, and contact your in-house IT manager. Your IT person is the one who knows context. They know who is on a work trip, who just changed roles, and whether a forwarding rule on a shared billing mailbox was set up on purpose.
Agree on one more thing in advance. If we see signs of a compromised account at 2 a.m., can we disable that account’s sign-in first and call your IT manager after? Having the answer in writing means nobody waits for permission while the attacker is working.
The finance lead owns the other half, which is the call-back rule inside the payment process. IT cannot enforce a phone call. Someone in accounts payable has to make it.
What to do this week
- Write the call-back rule on one page and give it to everyone who handles payments or payroll.
- Ask your IT manager whether alerts exist for new forwarding rules and impossible-travel sign-ins.
- Confirm MFA is on every mailbox, including shared ones.
- Check whether outside forwarding is turned off.
- Decide who can disable a compromised account after hours.
- Read your cyber insurance policy for what it says about fraudulent payment instructions. Terms vary.
Our email security page covers the monitoring side in more detail.
How we help
Kayak Cyber provides cloud detection and response for Microsoft 365. We watch sign-ins, risky logins, and new inbox forwarding rules, and we can disable a compromised account. Email security layered on Microsoft 365 reduces what reaches the inbox to begin with. Your internal IT team does not carry a pager alone, and your IT manager keeps the final say on anything that touches your people and processes. You can read how the arrangement works on our managed IT services page.
Call us at 405-253-5101 or schedule a discovery call to get on the calendar.