A well-written message can still ask the wrong person to do the wrong thing. It may name a real supplier, refer to an actual project, and arrive during a familiar conversation. None of those details establishes that a payment change or an account request is authorized.
Verify the requested action
A polished message can still ask for something the sender cannot authorize.
Teach staff to consider the requested action first. Money, credentials, authentication approvals, sensitive records, and a change to established procedures deserve verification even when the wording looks ordinary.
Use the business process as the check
The FBI's warning about AI-enabled fraud describes criminals using generated text to make messages more believable and reduce language errors. That removes a useful clue, but it does not require every employee to become skilled at detecting AI. The more durable check is whether the action fits the normal authorized process.
For a supplier bank change, use the existing verified contact record and require the agreed approval. For a request for credentials or an MFA code, use the known support route rather than complying in the message thread. A request for secrecy or an exception because someone is busy should increase the need to follow the process.
The payment verification guide makes the responsibility explicit. The person receiving a request should have a clear path to pause it, verify it independently, and obtain approval. Seniority does not make an exception safe; executives should follow the same rules.
Technical checks still help. Staff can inspect the full sender address and destination, while the email team manages authentication and filtering. A real account can also be compromised, so a matching address is one piece of evidence rather than permission to proceed.
Make checking easy to do
An awareness program works best when its instructions fit the job. Show finance how to verify a changed bank account. Show new employees how the real help desk contacts them. Show records staff where an authorized request for information enters the process.
Keep reporting simple and explain what happens after a report. Someone needs to review the message, decide whether related recipients should be warned, and coordinate any account action. A report button without an operational owner leaves the employee's part complete and the organization's part unfinished.
Our awareness guidance includes those practical handoffs. Staff should be able to ask about a message without embarrassment, including after they clicked. Blame and complicated reporting both encourage delay.
If someone already acted, establish what was disclosed or approved. A suspicious attachment opened, a password submitted, a code shared, and a transfer made require different follow-up. Preserve the original message for the response team.
The FBI's business email compromise guidance recommends independent verification of payment requests and prompt contact with the financial institution after fraud. Use the incident response process to coordinate technical and financial actions without waiting for certainty about every detail.
Choose a recent harmless example and walk the team through the verification route. Who holds the trusted contact details? Who can approve an exception? Who reviews the report? If the answers are unclear, fix the process before expecting staff to improvise it under pressure.