Stopping BEC in financial transfers: authentication that holds at funding
Finmail Security
Business Email Compromise does not need malware. It needs redirected trust: a note that looks like the CEO, outside counsel, or closing agent asking you to “use the new account.” For CFOs and dual-control approvers, the days around an M&A funding are the riskiest of the year.
Why closings are target-rich
Attackers mine deal news, LinkedIn moves, and signature blocks to craft display-name spoofs, thread hijacks from stolen advisor mailboxes, lookalike domains, and urgency scripts that crush callback discipline. Pure-text wire changes often skate past attachment-centric filters. Controls must rise to authentication plus process.
SPF, DKIM, DMARC
Publish tight SPF, rotate DKIM keys, and move DMARC from monitor to quarantine/reject with reporting. Staying on p=none forever advertises that forgery will not be forcefully handled. Finmail custom-domain activation requires live MX + SPF + DKIM and strongly recommends DMARC (see docs for report addresses).
What the client should show
Finmail’s Identity Verification Center surfaces SPF/DKIM/DMARC from headers on the stored message—not cosmetic guesses. A trusted-sender shield needs all three passing, non-junk placement, and no critical shield flags. If the display name looks like counsel but auth fails, stop the payment path and verify out-of-band.
Process controls that matter more than tools
Out-of-band callbacks on any beneficiary change; maker-checker separation; frozen templates for funding instructions; heightened verification when a counterparty announces a domain change.
Counterparty expectations
Ask advisors to publish DMARC posture, send funding mail only from listed addresses, and avoid mailing full bank letters when a Secure Share plus callback will do.
Dedicated financial email
Corralling high-value instructions onto a controlled domain shrinks the impersonation surface. It never replaces DMARC or callbacks.
Drills
Quarterly tabletop: auth-fail change request; auth-pass but wrong phone; brand-new domain claim. Train eyes on the underlying domain and auth panel, not the logo in the signature.
Monitor rua
SPF failure spikes may be forwarding debt—or reconnaissance. Keep multi-domain portfolios consistent.
Process when authentication is green
If an advisor mailbox is hijacked, SPF/DKIM/DMARC may pass. That is why callbacks and maker-checker still gate money. Maintain an offline phone book for closing agents; freeze beneficiary changes for a cooling period; never accept “temporary personal mail” for wire changes during an incident. Train staff that a green auth panel can still be an incident. Isolate closing payments from routine vendor AP habits so one urgent email cannot rewrite the closing memorandum.
Closing-week communications pack
Three days before funding, circulate: listed advisor domains; DMARC posture screenshots; callback phone book (offline copy); statement that mail cannot amend the funds-flow memo; Identity Verification Center screenshot legend for approvers. On funding day, any deviation triggers freeze—not debate. After funding, rotate temporary aliases and review rua aggregates for spoofing noise during the window.
Small-team minimum viable BEC controls
Two people can still enforce maker-checker, 24-hour new-account cooling, and callbacks. Tools without those habits become theater. Habits without DNS authentication invite lookalike domains. Deploy both.
Authentication literacy for approvers
Approvers need a two-minute lesson: where to find the Identity Verification Center, what pass/fail means, and why a pretty logo is irrelevant. Laminate that lesson next to the dual-control keyboard if you must. Phishing training that only shows fake login pages misses BEC’s text-only wire changes.
Vendor and counsel interdependence
Your DMARC cannot save you if the outside counsel domain is wide open and already compromised. Diligence includes their authentication posture and incident playbooks. Put domain lists into the closing checklist beside wire instructions. When they disclose an intrusion, freeze exceptions immediately—even if it delays interest calculations.
Lookalike domains and human vision
Homoglyphs beat tired eyes. Prefer copy-paste from an offline allow-list rather than reading addresses under fluorescent light at 1 a.m. If policy allows only a short list of funding counterparties, enforce that list in Delivery check required domains and in the payment system whitelist alike.
After a suspected BEC
Preserve headers, notify counsel and banks, assume other threads may be tainted, and rotate credentials. Do not negotiate with the attacker over email. Finmail’s audit export helps timeline reconstruction; law enforcement and bank recall processes sit outside the mailbox product.
See also existing mailbox vs dedicated address and Finmail vs Proton.
Your existing mailbox continues to receive day-to-day mail. Use this dedicated address for deals and confidential work.
Finmail does not send or receive BTC or USDT by email.
Next steps
Follow domain DNS and SPF/DKIM/DMARC. For a dedicated financial sending identity, start from pricing or Executive Inbox signup, and run one callback drill before the next large wire.