BEC defense playbook for cross-border M&A and large supply-chain settlements

Cross-border closing payments and large supply-chain wires are the CFO nightmare: bank details swapped, domains spoofed, on the night before sailing or signing. This playbook is not another protocol parameter sheet. It gives a drillable path—especially how attackers abuse the firm suite directory, and why large-wire instructions must be physically isolated from day-to-day company/public mail, with strict DMARC and pre-send attachment checks.

How suite penetration works (operator view)

1. Phish into an ops shared box, advisor mailbox, or VA account inside the suite.
2. Lurk for weeks on reconciliation habits.
3. Use the global directory to map CFO, treasury, outside counsel, and vendor-finance display names.
4. Append “updated remittance” on a real thread—or send from a lookalike domain; swap the PDF account page.
5. Urgency compresses review—“release tonight or interest accrues.”

The suite’s job is collaboration; collaboration widens directory and delegation. BEC need not break the bank host—it only needs a “looks legitimate” message inside a trusted thread.

Why “harden the suite” is still not enough

Purview, DLP, and awareness help inside the tenant. If above-threshold bank changes still default to that blast radius, attackers share a path with BAU noise. Physical isolation means: above-threshold confirmation does not complete in the BAU inbox. Meetings and vendor RFQs stay on the suite; closing and bank changes move to a Dedicated Plane.

Path A — Isolate the treasury confirmation plane

Control	Practice
Address	Finance-only dedicated address
Notice	Written cutover: bank changes only from allowlisted addresses
Process	Maker/checker; call-back; new-account cool-down
Systems	Confirm on mail plane; release in treasury/bank apps
Retire	Disable aliases at project close

Finmail can host that plane: Delivery check, scheduled send, Identity Verification Center, Secure Share; AskAI drafts verify lists—humans still reconcile numbers. Not end-to-end encryption; use an E2E product when contracts require server-unreadable mail.

Path B — Strict DMARC and read-side auth

1. SPF/DKIM on the treasury-confirmation domain; push DMARC to quarantine/reject.
2. Split marketing-send policy from treasury-confirmation policy.
3. Reviewers read Identity Verification Center results—not logos.
4. Ask core factories and closing agents to publish DMARC.
5. Auth pass only means “allowed into review,” not business truth—call-backs remain mandatory.

Path C — Pre-send attachment and delivery checks

Force on the compose path:

• recipient-domain allowlists / required matter codes (Delivery check);
• human tick: invoice/wire attachment matches body account;
• prefer Secure Share over infinitely copied PDFs;
• scheduled send to buy call time;
• careful mobile quick-replies.

Treat “attachment anomaly” as checklist + Delivery check—not a mythical auto-judge.

Joint drills for closing week and sailing windows

Quarterly tabletop three messages: (1) auth-fail bank change; (2) auth-pass but phone mismatch; (3) urgent instruction from a new domain. Build muscle memory; write outcomes on page one of the treasury policy.

Division of labor with other BEC guides

Protocol depth: BEC SPF/DKIM/DMARC. Outbound supply-chain wires: cross-border wire BEC. This handbook is the suite → isolation → DMARC → pre-send checks path a CFO can order.

Ninety days

Weeks 1–2 inventory above-threshold confirmation mailboxes; weeks 3–5 stand up the dedicated plane and DNS; weeks 6–8 notify counterparties and cut over; weeks 9–12 drill and measure (share confirmed on dedicated address, call-back rate, Delivery-check stops).

Closing

BEC exploits trust shortcuts at settlement. Split large instructions off the day-to-day suite; stack DMARC, identity verification, Delivery check, and call-backs so “looks like finance” stops at the gate.

Ten rules a CFO can issue

1. No above-threshold bank changes confirmed in BAU shared boxes.
2. No release without call-back.
3. Auth fail stops the flow—no “looks familiar.”
4. No “one-off exception” during new-account cool-down.
5. PDF account pages untrusted by default.
6. Treasury-confirmation DMARC must not linger forever at monitor-only.
7. Zero VA delegation onto treasury/wealth planes.
8. Scheduled send on during closing week.
9. Quarterly drills on the control calendar.
10. Board metrics: share confirmed on dedicated address + call-back completion.

Supply chain vs M&A closing nuance

Logistics urgency cites sailing cutoffs; M&A cites interest and default. Controls are the same; write both scripts into policy so staff do not think “call-backs are only for M&A.”

Metric board (three lines for the weekly treasury note)

1. Share of above-threshold wires confirmed on the dedicated address
2. Call-back completion rate on bank changes
3. Delivery-check near-miss stops

All three green before claiming “culture.” Persistent zeros usually mean the policy still lives in slides.

Lookalike domains and “looks internal”

Attackers copy signatures, disclaimers, even historic quote numbers. Train reviewers to open the full address and Identity Verification Center—not the display name. For internal “CEO says pay now,” policy should say: payment only via the approval system; mail is notice at most. Spoofed executive display names inside the suite still require call-backs.

Cut ERP digests away from CS

If ERP pushes payables digests to groups that include CS, attackers learn payment rhythm. Push digests only to treasury or the dedicated finance address; ops sees order status. Isolation starts in the notification matrix, not only in the mailbox product.

Counterparty notice you can paste

“From [date], changes to remittance account, beneficiary, or SWIFT path are accepted only from our allowlisted addresses with a registered call-back. Bank-change notes from day-to-day ops mailboxes or consumer free mail are void by default.” Sync into ERP vendor notes and the closing checklist.

Last mile of handbook execution

Controls without drills are slideware. Name a treasury owner for allowlisted addresses and offline call-back books, an IT owner for DMARC/DNS, and a compliance owner for metric sampling. Missing any corner, the handbook fails on the first sailing or closing week. Finmail supplies the plane and friction; ownership and drills must live in the client organization.

Next step

Rebuild confirmation from Pricing via Executive Inbox, and configure Delivery check plus Domain DNS.

See also deal mail vs VDR, Finmail vs Microsoft 365, and existing mailbox vs dedicated address.

Your existing mailbox continues to receive day-to-day mail. Use this dedicated address for deals and confidential work.