.svg)
.svg)
.svg)
.svg)
.svg)
Almost $3.05 billion was lost to business email compromise in 2025, second only to investment fraud and mostly through wire transfers, according to the FBI Internet Crime Complaint Center's 2025 annual report. The people who release those payments are accounts payable clerks, procurement officers and finance controllers, and the request that targets them rarely looks like the examples in a general phishing course. This guide is for security awareness managers and finance controllers who need business email compromise training built around that work.
In short: Train finance and procurement staff on the specific requests that reach them, make call-back verification a fixed habit, test it with role-matched simulations, and measure reporting and time to report rather than clicks alone.
Who Needs BEC Awareness Training
BEC awareness training is usually bought for the whole company and works best when it is built for a few people. A fake payment request only matters if the reader can release money, change a payee record or approve an invoice, so start with that list.
Accounts payable, treasury, procurement and the controllers who approve payments are the obvious roles. Add the executive assistant who manages a director's inbox and the staff who maintain vendor master data, because an attacker needs only one of them to make the request look routine.
General awareness still matters. The human element was present in 62% of breaches analyzed in the Verizon 2026 Data Breach Investigations Report, which covered more than 22,000 confirmed breaches. The finance desk is a separate audience because the same social engineering that works on anyone is worth far more when it lands on someone with payment authority.
What Business Email Compromise Training Must Cover
Content should follow the attacks, not the policy manual. These four scenarios are the ones to build around:
- Executive impersonation. An urgent, confidential payment request that appears to come from a senior leader.
- Supplier impersonation. A real supplier contact, or a lookalike, asks to change bank details before the next payment.
- Compromised supplier mailbox. A genuine account that an attacker has taken over sends a plausible invoice.
- The follow-up call. A phone call or message backs up the email and adds pressure.
Supplier impersonation training deserves the most time, because the request looks like routine administration. Learners should see the pattern in full: a bank-detail change that arrives just before a payment run. Our post on invoice fraud in UAE construction follows that decision point through one sector.
Each scenario needs the same three teaching points: what the request is trying to make the reader skip, which signals are worth noticing, and what to do next. Ireland's National Cyber Security Centre lists urgency, secrecy, external domains and an unusual tone as warning signs for finance and procurement staff, and advises against trusting a request on the sender's name alone or assuming a caller is genuine because the voice sounds familiar.
Fraus Codex delivers business email compromise content as micro-learning in Arabic and English, so staff can work through short scenarios in the language they use at their desk.
Verification Habits That Hold Under Pressure
Knowing the signs is not enough, because a convincing request arrives when the clerk is busy. The habit has to be a step that happens whether or not anything looks wrong.
The central habit is call-back verification. The NCSC guidance says a quick update to bank details should always trigger a phone call to a known contact. Make that call to a number you already hold, never one supplied in the request, and teach it as a fixed step for any change to payee details.
BEC prevention for employees also needs controls that give staff cover to slow down:
- A second approver for payments above a set threshold.
- A built-in delay on large or first-time payments so checks can run.
- The same call-back rule for urgent requests from executives.
- A named channel for reporting a suspicious request, with no blame for a false alarm.
The last item matters most for behavior. The NCSC advises reporting suspected incidents quickly and without embarrassment, and training should say so out loud, because a person who expects blame reports later.
Simulation for Finance and Procurement
Habits fade unless they are tested. A simulated supplier bank-detail change shows whether the call-back actually happens, which a quiz cannot.
Match each scenario to the role. Accounts payable gets the invoice with new bank details, procurement gets an onboarding request from a new vendor, and the executive assistant gets the urgent message from a director. Run them in Arabic as well as English where staff work in both, and raise the difficulty as people improve.
Fraus Whitebait runs AI-recommended campaigns for UAE and GCC organizations with Arabic and English templates, and tracks reporting rate next to click rate. For a finance team the report matters more than the click: the right response to a fake bank-detail change is to verify and report, and the debrief should name the step the person skipped.
Measuring Whether Behavior Changed
Completion rates show that people watched something. For BEC, track what happened when a request arrived: whether it was reported, how long that took, and whether the call-back came before any payment step.
Track reporting rate and time to report by team, so the accounts payable group is not hidden inside a company average, and watch which individuals miss the same scenario twice.
Repeat misses call for a different next step, not the same course again. Fraus Odin scores risk per employee and weights it by role criticality, so a clerk with payment authority and a repeat miss is escalated ahead of someone with no access to funds, and training can be recommended or assigned automatically.
Start With One Payment Run
Go back to the clerk with a bank-detail change on the day before a payment run. Pick that one team and that one scenario first. Write the call-back step down, train the team on it, send one matching simulation and see who reports and how fast.
If the result shows the call-back is skipped under time pressure, the fix is rehearsal, and role-matched simulation repeated over the year provides it. Use what you learn to choose the next scenario and the next role.
Frequently Asked Questions
What should business email compromise training cover?
It should cover the requests that reach finance and procurement staff: executive impersonation, supplier bank-detail changes, compromised supplier mailboxes and follow-up calls. For each, teach what the request tries to make the reader skip, the signals to notice and the verification step to take, which is a call-back on a number already on file.
Who should take BEC training?
Anyone who can release a payment, change payee details or approve an invoice, plus the people who support them, such as executive assistants and vendor master data staff. Start with accounts payable, treasury, procurement and approving controllers, then widen to the rest of the company with shorter general content.
How do you test whether BEC training works?
Send simulations that match each role, such as a supplier bank-detail change for accounts payable, and record who reports, how quickly, and whether the call-back was made. Compare results by team over time instead of relying on course completion or a single click rate.
How is supplier impersonation training different from phishing training?
Phishing training teaches people to spot a suspicious link or attachment. Supplier impersonation training teaches them to question a request that has neither, such as a polite note asking to update bank details, and to verify it through a known phone number before any payment step.
.png)
.png)
.png)
