Business Email Compromise Verification for Executive Assistants in 2026

Research question

What operating evidence shows that executive assistants verify high-risk requests through an independent channel before releasing money, gift-card value, credentials, sensitive information, or changes to vendor records?

Executive support is a natural target for business email compromise because assistants act on an executive's instructions, understand travel and availability, coordinate vendors, and may be trusted to move quickly. A fraudulent request does not need to look technically sophisticated. It can use a familiar writing style, a nearly correct address, a real invoice thread, or accurate knowledge of an executive's schedule.

This analysis uses public material from the Federal Bureau of Investigation. It translates that material into operating controls for executive support; it does not estimate an organization's loss probability or promise that a checklist will prevent fraud. Security, finance, legal, banking, insurance, and law-enforcement owners should define the applicable response.

What the FBI guidance establishes

The FBI's Internet Crime Complaint Center business email compromise alert explains that BEC can use compromised legitimate accounts, virtual meeting platforms, altered payment instructions, and requests for business or personal information. These patterns matter to assistants because legitimate context or a familiar account can be present in a fraudulent instruction.

FinCEN's advisory on email compromise fraud describes changed beneficiary details, lookalike addresses, unusual timing, urgency, confidentiality demands, and instructions based only on an unverified executive email. It states that multifaceted transaction verification can help guard against BEC and discusses using multiple communication methods or contacting other authorized people.

The control lesson is that an authenticated email account is not the same as an authenticated instruction. A legitimate mailbox can be compromised. Replying within the same thread or calling a number in the message can keep the assistant inside the attacker's channel.

Define high-risk request classes

Verification should be triggered by the action, not only by how suspicious the message looks. Define classes that require an independent check: new or changed payment details, wire or ACH requests, gift-card purchases or serial numbers, payroll changes, credential resets, release of confidential files, new forwarding rules, unusual travel payments, and urgent changes to vendor identity.

The organization should set thresholds and exceptions, but some controls should apply regardless of amount. A low-value successful request can test whether a mailbox, process, or employee is exploitable. Repeated small gift-card requests can also create significant exposure.

Add change-based triggers. A familiar vendor asking for payment to a new account, an executive using an unfamiliar channel, a request to avoid normal approvers, or a sudden confidentiality demand should move the request into verification. Genuine urgency does not remove the need; the fast path should preserve separation and known-channel confirmation.

Document what the assistant must never do. Examples include sending gift-card numbers by email, changing payment data based on a message alone, approving one's own request, using a phone number supplied in the request to verify it, or bypassing the case record because the executive is traveling.

Build a known-channel verification directory

Independent verification only works if trusted contact information exists before the request. Maintain approved contact channels for executives, finance owners, procurement, payroll, key vendors, and banking partners. Control who can change this directory and require separate review for contact updates.

The directory should not expose personal numbers broadly. Role-based access can let an assistant initiate a verification call without exporting the entire contact list. Record the source and last confirmation date.

A number copied from an email signature in the request is not independent.

For executive requests, agree on a verification protocol that survives travel, meetings, and device loss. This can include a known callback route and a named alternate approver. Avoid shared secret phrases that are static, widely known, or stored next to the procedure.

Voice familiarity alone is increasingly weak evidence and should not replace the approved channel and transaction details.

For vendors, separate relationship coordination from master-data changes. The assistant can collect a request, but finance or procurement should validate it through the established vendor contact and update the controlled system. Payment staff should use the approved record, not bank details pasted into a calendar note.

Separate request, verification, approval, and execution

A durable workflow records four distinct events. The request captures who appeared to ask, what action was requested, the amount or asset where relevant, the deadline, and the original message reference. Verification records the independent channel, contacted party, time, and confirmed transaction details.

Approval records the authorized decision. Execution records who performed the action and the system confirmation.

One person may hold more than one role in a small organization, but the system should still preserve separate events and any required second approval. For material transactions, separation reduces the chance that one compromised account or hurried employee can complete the entire chain.

Use a neutral pending state. “Awaiting independent verification” lets the assistant pause without accusing the requester. The executive should endorse that pause in advance so attackers cannot exploit fear of appearing unresponsive.

Do not move sensitive evidence into a broad chat channel. Preserve the original message, headers or security artifacts according to the incident process. A payment case can reference restricted evidence.

Avoid forwarding a potentially malicious attachment merely to ask a colleague whether it looks real.

Design an urgent-response and recovery route

If an assistant suspects a request before action, the first steps are to stop, preserve, verify through the known channel, and notify the defined security or finance owner. The owner decides whether to isolate an account, reset credentials, inspect forwarding rules, warn affected parties, or take other technical steps.

If money or value has already moved, speed matters. The FBI advises contacting the financial institution immediately and reporting BEC to the Internet Crime Complaint Center. Organizations should pre-document bank contacts, after-hours contacts, insurance notification, legal escalation, and evidence-preservation responsibilities rather than searching during an incident.

Do not make the assistant investigate the mailbox or contact a suspected attacker. Technical responders should preserve logs and determine scope. The assistant can provide the request context, actions taken, known communications, and relevant timestamps.

Recovery should address process as well as credentials. A compromised mailbox may reveal calendars, vendor relationships, language patterns, invoices, and travel. Review which future requests an attacker could imitate and whether vendors or clients need controlled notification.

Train with realistic executive-support scenarios

Scenario training should include a CEO gift-card request, a vendor bank-account change inside a real thread, an urgent travel deposit, a payroll update, and a confidential document request sent while the executive is unavailable. Use safe simulations that do not collect real credentials or shame employees.

Measure whether the participant recognized the action class, used the known channel, avoided attacker-supplied contact details, preserved the request, and reached the correct owner. Clicking a training message can be one signal, but it is not the whole control. Business-process verification is the central behavior.

Substitute and after-hours assistants need the same directory and authority to pause. An attacker may exploit coverage changes, holidays, time zones, and travel. Test the alternate approver and finance contact rather than assuming the primary executive will always answer.

Reinforce that polished writing and accurate context do not prove authenticity. Conversely, awkward language is not proof of fraud and can produce bias against legitimate international colleagues. The decision rule should rest on the requested action and verification control.

Measure the verification system

Useful measures include high-risk requests routed through verification, contact-directory freshness, bank-detail changes independently confirmed, unresolved pending requests, attempted bypasses, time to financial-institution contact after a loss, and corrective actions closed after exercises or incidents.

Do not celebrate a high number of “suspicious employees reported.” Measure the system's ability to interrupt risky actions without penalizing good-faith reports. Track false alarms as workflow learning, not individual failure.

Audit a sample end to end. Confirm that the known channel existed before the request, verification covered the material details, approval was authorized, execution matched the verified data, and records were appropriately restricted. Test an urgent case and an alternate-coverage case.

Evidence to request from an executive-assistant provider

Ask the agency which payment, purchase, vendor, credential, and document actions placed assistants can initiate. Request the high-risk action list, independent-verification rule, directory control, pause authority, alternate coverage, security escalation, and post-transfer response.

Review a de-identified exercise showing the original action class, independent channel, approval, execution, and follow-up. Confirm that the agency does not rely on email replies, executive writing style, or static passwords as the sole proof.

Clarify the client-agency boundary. The client may own finance systems and bank relationships while the agency owns assistant training and incident support. A placed assistant needs one coherent route with named contacts on both sides.

Limits and decision use

This framework does not replace technical email security, identity controls, bank protections, insurance requirements, legal advice, or law-enforcement guidance. Attack methods and reporting instructions can change. Organizations should maintain current incident contacts and response procedures.

Independent verification introduces a small amount of friction exactly where impersonation exploits speed and hierarchy. The goal is not suspicion of every message. It is a predictable, executive-endorsed pause for actions that can move value, access, or sensitive information.

Teams can compare this framework with the executive operations research library and C-suite executive assistant support. Organizations that need to define request, verification, approval, and execution boundaries can start a support-design conversation with security, finance, procurement, legal, and executive owners involved.