It is the Wednesday before Thanksgiving. Half the office left at noon. The controller is trying to close out vendor payments before the long weekend, the CFO is boarding a flight to see family, and the CEO is somewhere between a client lunch and the airport. At 2:47 p.m., an email lands in accounts payable from a long-standing supplier. It is polite, references a real invoice number, and says the company has changed banks and needs this month’s payment sent to the new account. A few minutes later, a short follow-up comes from the CFO’s address: “Please make sure this goes out today; we can’t be late with them again.”

The payment goes out. Nobody thinks about it again until the real supplier calls the following Tuesday asking where their money is.

No malware was involved. No firewall was bypassed. Nobody clicked a bad link. Someone simply did their job, quickly, under pressure, and trusted what they were told. That is what business email compromise looks like, and it is why I want to spend this month’s post on it.

Why November Is Prime Time for Business Email Compromise

Attackers are good at reading calendars. The weeks between Thanksgiving and year-end are some of the most attractive of the year for payment fraud. Staffing is thin, approvers are traveling, year-end invoices pile up, vendors really are updating banking details for the new year, and there is a natural urgency to clear everything before the books close. Every one of those conditions makes an unusual request feel normal.

The numbers back this up. The FBI’s 2025 Internet Crime Report recorded more than $3.04 billion in business email compromise losses across 24,768 complaints, making it the second most costly category of cybercrime reported to the Bureau, behind only investment fraud. That same report shows total reported losses passing $20.8 billion, a 26% increase over 2024. Business email compromise is not a fringe threat. It is one of the most reliable ways criminals take money from organizations, and it works on companies of every size.

This Is a Leadership Problem, Not an Email Problem

When I talk with executives about this, the conversation usually starts with filters and tools. Those matter, and I will get to them. But the uncomfortable truth is that the fraud I described above succeeds because of how the organization behaves, not because of what software it runs.

Think about what the attacker actually exploited in that story. They exploited a culture where a request from the CFO is not questioned. They exploited a process where a bank change can be made on the strength of an email. They exploited the fact that nobody felt comfortable calling the CFO on vacation to double-check. And they exploited the time pressure leadership itself created by wanting everything closed before the holiday.

Those are all decisions leaders make, usually without realizing it. The good news is that leaders can also unmake them.

Make It Safe to Slow Down

The single most effective thing an executive can do is tell their finance team, out loud and in writing, that they will never be criticized for verifying a payment request, even one that appears to come from the CEO. Then they have to mean it. If a staff member calls you at the airport to confirm a wire, the right response is “thank you for checking,” not irritation.

Attackers depend on people being afraid to question authority. When your team knows that slowing down is expected and rewarded, the pressure tactics stop working.

Verify Out of Band, Every Time

Confirm any change to vendor banking information, and any urgent or unusual payment request, through a channel the requester did not provide. That means calling the vendor at the phone number already on file, not the one in the email signature. It means walking down the hall, or calling the executive’s known mobile number, rather than replying to the message. It sounds simple because it is simple. It also stops the vast majority of these schemes cold.

I would also encourage leaders to build in a short holding period for new or changed payment details. A 24- to 48-hour delay on first payments to a new account, paired with a callback, costs you very little and removes the urgency an attacker needs.

Protect the Accounts Attackers Want Most

Many of these schemes do not use spoofed addresses at all. They come from real mailboxes that were quietly taken over weeks earlier, often an executive’s or someone in finance. The attacker reads the email, learns who pays whom and when, and waits for the right moment. That is why the follow-up in my story looked so convincing. It may have come from the CFO’s actual account.

Strong multifactor authentication on every mailbox, especially for executives and finance staff, is no longer optional. Neither is watching for the warning signs of a compromised account, such as new mail forwarding rules, unusual sign-in locations, or messages being silently moved out of the inbox.

On the domain side, properly enforced SPF, DKIM, and DMARC make it much harder for someone to send mail that pretends to be from your company. If you are not sure where your organization stands on any of these, ask your IT team before the holidays, not after.

Stay safe, and have a great Thanksgiving.