Business Email Compromise Training SOP¶

Sub-procedure for Operate pillar managed services - Wire fraud awareness training

Service Pillar: Operate Service Category: Wire Fraud Prevention Parent SOP: Security Training SOP Engagement Type: Training Engagement / Ongoing Program

Overview¶

Specialized security awareness training focused on Business Email Compromise (BEC) and wire fraud prevention. This training program targets high-risk personnel including executives, finance teams, and administrative staff with role-specific content designed to help them recognize and respond to sophisticated social engineering attacks.

Scope¶

Pillar: Operate (Managed Services) Service Area: Wire Fraud Prevention - BEC Training

In Scope¶

Executive-targeted BEC awareness
Finance/accounting team training
Executive assistant training
HR payroll fraud awareness
Vendor payment security training
Simulated BEC attack exercises
Reporting procedure training

Out of Scope¶

General security awareness (covered in Security Training SOP)
Technical security training
Compliance-specific training (HIPAA, PCI)

Prerequisites¶

Completed BEC Assessment or identified training need
Executive sponsorship (CEO/CFO)
High-risk user list identified
Training platform access (if computer-based)
Scheduling coordination with department heads
Baseline metrics from previous phishing tests
Approval for BEC simulation exercises

Procedure¶

Step 1: Training Needs Analysis¶

Objective: Customize training content for organization-specific risks

Activities: 1. Review BEC assessment findings 2. Analyze previous phishing test results 3. Identify role-specific vulnerabilities 4. Document organization's financial processes 5. Understand vendor relationship patterns 6. Identify recent industry BEC incidents

Role-Based Training Needs: | Role | Primary Threats | Training Focus | |------|-----------------|----------------| | CEO/Executives | Impersonation as sender | Awareness of how they're spoofed | | CFO/Finance | Payment fraud targets | Verification procedures | | Exec Assistants | Gift card/payment requests | Verification of executive requests | | AP/AR Staff | Vendor impersonation | Payment change verification | | HR | Payroll diversion | Direct deposit change procedures |

Duration: 2-3 hours

Step 2: Training Content Development¶

Objective: Create or customize BEC-specific training materials

Core Training Modules:

Module 1: Understanding BEC (30 min) - What is Business Email Compromise - Financial impact and real-world examples - Why attackers target our organization - Attack lifecycle and timing patterns

Module 2: BEC Attack Types (45 min) - CEO/Executive fraud - Vendor email compromise - Attorney impersonation - Payroll diversion - Gift card scams - Data theft variants

Module 3: Red Flags & Detection (45 min) - Email header analysis - Urgency and pressure tactics - Unusual payment requests - Changes to vendor banking - Out-of-character communications - Domain spoofing indicators

Module 4: Verification Procedures (30 min) - Callback verification protocols - Out-of-band confirmation - Escalation procedures - "When in doubt" policies - Documentation requirements

Module 5: Reporting & Response (30 min) - How to report suspected BEC - What to do if you clicked/responded - Internal escalation path - Law enforcement notification - Recovery procedures

Duration: 8-12 hours (content development)

Step 3: Executive Briefing Session¶

Objective: Provide leadership-specific BEC awareness

Session Format: 60-minute executive session

Agenda: 1. Current threat landscape (15 min) 2. How executives are impersonated (15 min) 3. Organization-specific risks (10 min) 4. Leadership role in prevention (10 min) 5. Q&A and policy discussion (10 min)

Key Messages for Executives: - Your identity is a weapon used against your employees - Attackers study your communication patterns - Your support of verification policies is critical - Model behavior: never request urgent wire transfers via email

Duration: 1-2 hours (prep + delivery)

Step 4: Finance Team Workshop¶

Objective: Deep-dive training for accounts payable/receivable staff

Session Format: 2-hour interactive workshop

Workshop Components: 1. BEC case studies specific to finance (30 min) 2. Hands-on red flag identification exercise (30 min) 3. Verification procedure walkthrough (30 min) 4. Tabletop scenario exercise (30 min)

Scenario Examples: | Scenario | Attack Type | Expected Response | |----------|-------------|-------------------| | CEO requests urgent wire | CEO Fraud | Callback to CEO, escalate | | Vendor sends new bank info | Vendor Compromise | Callback to known contact | | Attorney requests closing funds | Attorney Impersonation | Verify with transaction parties | | HR receives direct deposit change | Payroll Diversion | In-person/phone verification |

Duration: 3-4 hours (prep + delivery)

Step 5: BEC Simulation Exercises¶

Objective: Test and reinforce training through realistic scenarios

Simulation Types:

Type 1: Phishing Simulation - Spoofed executive email - Urgency-based requests - Vendor impersonation attempts - Measure: Click/report rates

Type 2: Tabletop Exercise - Walk through BEC scenario - Test decision-making - Identify process gaps - Measure: Response quality

Type 3: Live Drill - Simulated BEC call to finance - Test verification procedures - Time response metrics - Measure: Procedure compliance

Simulation Schedule: | Exercise Type | Frequency | Target Audience | |--------------|-----------|-----------------| | Email phishing | Monthly | All high-risk users | | Tabletop | Quarterly | Finance team | | Live drill | Semi-annual | AP/Treasury |

Duration: 4-8 hours per simulation cycle

Step 6: Training Metrics & Reporting¶

Objective: Measure training effectiveness and identify improvement areas

Key Metrics: | Metric | Target | Frequency | |--------|--------|-----------| | Training completion rate | 100% | Monthly | | Phishing simulation click rate | <10% | Monthly | | Phishing report rate | >70% | Monthly | | Verification procedure compliance | >95% | Quarterly | | Time to report suspicious email | <5 min | Quarterly |

Reporting Deliverables: - Monthly phishing simulation results - Quarterly training effectiveness report - Annual program review and recommendations

Duration: 2-4 hours monthly

Deliverables¶

Deliverable	Format	Owner
Training Needs Analysis	Word	Lead Consultant
Custom Training Content	PPT/LMS	Training Specialist
Executive Briefing Deck	PPT	Engagement Manager
Finance Workshop Materials	PPT/Workbook	Lead Consultant
Simulation Results Report	PDF	Training Specialist
Quarterly Training Report	PDF	Engagement Manager

Quality Gates¶

Training content customized for organization
Executive sponsorship confirmed and visible
All high-risk users completed training
Simulation exercises conducted post-training
Measurable improvement in simulation results
Verification procedures documented and trained
Ongoing training calendar established
Training records maintained for compliance

Last Updated: February 2026