Prepare for email fraud.

By Tyler Mayberry · Cirlet. Checked October 22, 2026. Examples are fictional; they are not accounts of agency victims.

Business-email compromise can exploit a compromised account, a lookalike address or a convincing request. AI may improve the deception, but you do not need to determine how a message was written before verifying a sensitive request.

Ask your provider.

• Who owns mailbox security, MFA and account recovery?
• How are suspicious sign-ins and unexpected forwarding rules reviewed?
• Who checks SPF, DKIM and DMARC against legitimate senders?
• How do staff report a suspicious message, and who receives it?
• What is the approved contact route if your normal email account is unavailable?

If compromise is suspected

Contact your designated IT/security provider using a known, separate route and follow the established incident procedure. For a suspected fraudulent transfer, promptly contact the financial institution through its established fraud channel and follow applicable reporting instructions. Preserve evidence. This resource does not provide emergency response or personalized legal/coverage advice.

A fictional rehearsal

A message from a familiar-looking carrier address asks for a payment-routing change. The employee uses the approved carrier contact to verify it. The team records who handles the request, who contacts the provider and where evidence is retained. No money or real customer data is needed for the rehearsal.

Check public email records · Build the provider checklist

Sources: FBI impersonation advisory; FBI business-email compromise guidance. Checklist is Cirlet’s agency-oriented synthesis; this page does not verify your tenant’s controls.