Business Email Compromise: How Finance Teams Can Reduce Risk

A Dubai distributor is preparing its weekly supplier payments. One supplier appears to reply to an existing invoice thread with a new beneficiary account and asks for payment before the end of the day. The message carries the right invoice number and the usual signature. The employee can recognize the transaction and still have no reliable basis for trusting the new instruction. The control that matters is what the finance system and approver require before money can leave.

Business email compromise exploits trusted communication to divert a payment or induce another unauthorized action. A criminal can impersonate a supplier or use a genuine mailbox after gaining access. Build the payment process around verified beneficiary records, a separate confirmation channel and an approver who can see what changed. Give the team a short procedure for suspected fraud so it can contact the bank and contain the exposure without waiting to reconstruct the entire incident.

Separate the invoice from authority to change a beneficiary

An invoice can establish what the supplier says the company owes. A request to change where the money goes needs its own evidence. The UAE Financial Intelligence Unit's fraud analysis describes business email compromise as a form of payment diversion and discusses scenarios involving legitimate communications and unauthorized changes to bank or beneficiary details. For the buyer, a message that resembles a genuine supplier request deserves the same verification as any other proposed change. UAE Financial Intelligence Unit fraud analysis

Record supplier contact details during onboarding and check them independently. Keep the approved contact in a controlled supplier record. When a request arrives, use the previously verified channel to reach an authorized person. If the supplier says that both its bank account and its contact details have changed, verify the new contact from an independent source before using it to confirm the banking instruction. Calling a number supplied in the same email can simply take the finance team back to the sender.

Have the person taking the confirmation record the supplier, the date, the contact used and the fields confirmed. Limit exposure of full banking details to staff who need them. Document what happens when the contact cannot be reached. The normal response can be to keep the change pending and escalate the impact on the payment date. Agree a process for genuinely urgent requests before the team faces a deadline.

Protect the full path from change request to bank release

Assign separate roles for entering, verifying and approving beneficiary changes where staffing permits. In a small team, the owner might perform the independent check for changes entered by a finance employee. Check what happens if the owner is away. An alternate approver should have known authority and access to the same evidence. A two-person rule has limited effect when both people rely on the same unverified message.

Review the bank portal as a separate step. A change approved in the accounting system may still be entered incorrectly in the bank or altered in a file before upload. Have the approver compare the beneficiary and amount shown at release with the approved record. Where the bank supports separate approval roles or waiting periods for new beneficiaries, confirm which features are enabled for the actual account and payment channel. Emirates NBD's fraud awareness page, for example, discusses a cooling period between adding a beneficiary and transferring funds in its businessONLINE guidance. Ask your own bank about the controls available under your arrangement. Emirates NBD fraud awareness and reporting

Keep beneficiary administration limited to named accounts and check whether a user can both add and release a payment. Revisit access when someone leaves, changes jobs or works as temporary cover. Review payment alerts and the queue of pending changes. If the system allows a manual bank transfer outside the main batch, include it in the same verification procedure. A control on the standard path leaves a gap when staff can complete the same action through an exception channel.

Make the beneficiary change visible for long enough to catch the first payment. If the accounts system records a change but the bank batch shows only a name and amount, give the approver a separate report of recently changed accounts and a secure way to compare the relevant fields. Check the report against a batch that contains several payments to the same supplier. The first transfer and any later installments should follow the verified record.

Review how new suppliers are added during a rush. An employee who cannot amend an existing beneficiary may still be able to create a second supplier record with a similar name. Check for duplicates when approving a new record, and investigate legitimate cases where one supplier uses more than one account. Agree what proof ties each account to the supplier and the transaction.

Rehearse the cases most likely to pressure staff

Use a test supplier and a transfer that cannot be released. Send a simulated change to a familiar invoice close to the cutoff. Include an accurate invoice reference and a request to keep the matter confidential or to skip the usual approver. Watch where staff obtain the supplier's contact details, what they compare and whether the instruction stays pending while verification is open. Then run a genuine test change and confirm that the process can approve it without unnecessary delay.

Exercise a few variations. A supplier might send a new invoice with the old contact details but different banking information. A request might claim to come from the company's director and instruct staff to pay an unfamiliar beneficiary. A caller could impersonate the supplier after an email arrives. In each case, test whether staff can use an established route and whether the approver can check the resulting evidence. The exercise is about the decisions staff make under pressure, including where they go for help when a deadline is real.

Measure what the team actually verifies. Suppose a hypothetical month contains 40 beneficiary changes and 38 have evidence of independent confirmation. That is 95% coverage, with two gaps. If both gaps involve first payments to new accounts, review those cases individually. Ask whether they were genuine controls performed without a record or payments released without verification. The correction differs, and the percentage alone cannot tell the owner which issue needs attention.

Act quickly when a payment may have been diverted

If a payment is pending, notify the person who can stop or hold it under company procedure. If a transfer has been released or its status is unclear, contact the originating bank immediately through a trusted channel. Have the transaction reference, amount, currency, timestamp and beneficiary information available. Ask what options exist to stop, trace or request a recall, and keep the bank's reference. The available response and whether funds can be recovered depend on the circumstances. Avoid promising a recovery date to the supplier or assuming the original invoice has been settled.

Have an incident owner coordinate finance and IT. Preserve the original email and relevant attachments or headers, approval records, payment instructions and bank confirmations in a restricted location. Note who received the request, when the change was entered and which accounts or systems may be affected. Confirm the supplier's position through a trusted channel. If the same credentials or beneficiary record were used for other payments, review related transactions and pending batches.

For the technical response, ask the responsible team to assess whether a mailbox or financial account was compromised. It may need to review active sessions, forwarding rules, account recovery settings and connected applications, then contain access under its incident procedure. A password reset alone may leave another route open. Use a separate communication channel for the response if there is reason to suspect the mailbox remains accessible to someone else.

The UAE Government's economic crimes reporting guidance points people to the relevant local police for fraud and cybercrime and identifies Dubai Police's eCrime route for cyber-enabled financial crimes in Dubai. Use the applicable official channel and follow the organization's requirements for reporting and preserving evidence. Keep bank, police and internal case references distinct so each can be used for the right follow-up. UAE Government guidance on reporting economic crimes

A Dubai Consumer Rights reel illustrates following up on a reported issue. For a suspected payment diversion, keep a similarly traceable internal record while using the bank and applicable police channel for the incident itself. Name the person who will check the next status update and who will tell finance when it can resume the affected payment activity.

Keep a contact sheet for the people who can act on short notice. Verify the bank contact through the bank’s official site or an existing relationship channel and store it where the team can access it during an email outage. Walk through what happens if the issue is discovered after hours. The person who spots the payment may need authority to call the bank before the usual approver is reachable. Agree who makes that call and who takes over the case afterward.

Close the gaps the incident or rehearsal exposed

Reconstruct the path from the first request to bank release. Identify the point where a verified instruction should have replaced the email, and determine why it did not. If the team did call the supplier, check where the number came from. If a second person approved the change, ask what they were able to see. Fix the step that allowed the instruction through and repeat the exercise with a different supplier and an absent approver.

Review outstanding invoices and correct the supplier record only after obtaining verified instructions. Give staff a way to distinguish the suspicious payment from any genuine amount the company still owes. Finance and the responsible decision maker should agree how to deal with any remaining obligation, documentation or dispute. Keep the incident and reconciliation records available to the people responsible for the next payment run.

A finance team can begin with the highest-risk workflow, such as new beneficiaries and changes to an existing supplier's account. Test a change from receipt through release, check the bank and incident contacts, and reconcile the approval evidence after the next payment cycle. The company should be able to show who confirmed the instruction, who released the transfer and what staff will do if those details turn out to be wrong.