Workplace & institutional
The email that changes a vendor's bank account is the most expensive email your company will receive
Business email compromise does not need malware. It needs a lookalike domain, a quiet month of reading your mail, and one person in accounts who trusts a PDF. This session uses real Indian cases to show how the fraud is set up, and installs the one control that defeats all of it: a callback on a known number before any bank-detail change or urgent payment.
- Duration
- 2 hours
- Format
- Online / Onsite
- Language
- English / Hindi
- Level
- Intermediate
- Group size
- 5 to 60
- Certificate
- Completion certificate
- For
- CFOs, accounts payable, treasury
What participants can do afterwards
- Recognise the four BEC patterns (vendor bank change, CEO urgent payment, payroll diversion, lawyer or auditor pretext) from the first email
- Apply a callback-and-verify rule for every bank-detail change and every out-of-process payment request, with no exceptions for the MD
- Spot lookalike domains, display-name tricks, reply-to changes and mailbox forwarding rules
- Know the first-hour steps after a wrong payment: bank recall, 1930 and cybercrime.gov.in, CFCFRMS freeze, and evidence capture
- Understand what DMARC, SPF and DKIM do for your own domain, and why they are a finance problem, not just an IT one
Modules
Anatomy of a BEC case
A reconstructed Indian case from first phishing mail to the wire, with the attacker's mailbox rules shown.
The four patterns
Vendor bank change, CEO urgent payment, payroll diversion, auditor or lawyer pretext. Real emails, with what gave each away.
Controls that work
Callback on a known number, dual authorisation, a vendor master change process, and the "no exceptions" rule for senior staff.
The technical side in plain words
Lookalike domains, display names, MFA, mailbox rules, and DMARC for your own domain so vendors cannot be fooled in your name.
The first hour after a wrong payment
Bank recall request, 1930, the portal, CFCFRMS freezing, evidence, and who to tell internally.
Tabletop
Thirty minutes on a vendor-change scenario with your own process, to find the gap before an attacker does.
Who should attend
- CFOs, finance controllers and accounts payable teams
- Treasury and payments staff in NBFCs, exporters and manufacturers
- Company secretaries and internal audit
- Vendor-management and procurement staff who handle bank details
Included
- Trainer with reconstructed cases and example emails
- A one-page vendor bank-change and payment verification procedure you can adopt as is
- A first-hour response card for wrong payments with 1930 and the bank recall steps
- A short note for IT on DMARC, SPF, DKIM and mailbox-rule monitoring
Frequently asked questions
Our ERP has maker-checker. Is this still needed?
Yes. Maker-checker catches an unauthorised payment, not an authorised payment to the wrong account. In most BEC cases both the maker and the checker saw a genuine-looking vendor letter and approved. The missing control is a callback to the vendor on a number you already had, before the master data is changed. The session shows how to build that into your existing process.
Can you run the tabletop on our actual vendor-change process?
Yes, and that is the most useful part. Send us your current procedure a week in advance, and we build the scenario around it. The exercise usually surfaces two or three gaps, such as a change accepted by email alone, an exception path for urgent payments, or a senior person who can override the checker. You leave with the fixes written down.
What happens if a payment has already gone out before the session?
Tell us, and we will spend time on it. The first-hour steps are a bank recall request through your relationship manager, a 1930 call and cybercrime.gov.in complaint so CFCFRMS can attempt a freeze, and evidence capture of the emails with full headers. Speed matters far more than the amount. We can also help with the complaint and evidence afterwards.
Is this suitable for a company with a small accounts team?
Yes. For a team of five, we run it online in two hours with the tabletop built around how you actually pay vendors. Small exporters and manufacturers are targeted precisely because one person handles both the vendor relationship and the payment. The verification procedure in the handout is written so that a two-person team can follow it.
Request this program
Tell us the audience, headcount, city and preferred dates. We reply with an outline and quote.