Business Email Compromise: Payment Approval Controls for CFOs
A CFO control for compromised mailboxes, spoofed domains, fake executives, vendor-bank changes, invoice manipulation, urgent transfers and evidence.
BEC succeeds when the payment process treats a familiar name or email thread as authentication.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; Consent Manager-related provisions follow after one year; most operating duties and Rules follow eighteen months after Gazette publication. As of 22 June 2026, the control should distinguish current obligations from future-state DPDP readiness.
BEC can involve compromised accounts, lookalike domains, forwarded threads, voice cloning and changed bank instructions.
Financial-fraud response requires immediate bank contact and official reporting because recovery opportunities decline rapidly.
CERT-In reporting may apply where the event is a covered cyber incident.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; Consent Manager-related provisions follow after one year; most operating duties and Rules follow eighteen months after Gazette publication. As of 22 June 2026, the control should distinguish current obligations from future-state DPDP readiness.
- BEC can involve compromised accounts, lookalike domains, forwarded threads, voice cloning and changed bank instructions.
- Financial-fraud response requires immediate bank contact and official reporting because recovery opportunities decline rapidly.
- CERT-In reporting may apply where the event is a covered cyber incident.
- Technical email controls help, but independent transaction verification and dual approval remain essential.
The five-point review
| Check | What to examine |
|---|---|
| Request | Payment, bank change, data or credential. |
| Identity | Domain, reply path, account and device. |
| Transaction | Amount, beneficiary, urgency and exception. |
| Verification | Known callback and secure workflow. |
| Evidence | Headers, messages, bank and access logs. |
Practical example
A genuine vendor mailbox is compromised and sends a bank-change request within an existing invoice thread. Domain checks pass, so the AP team must still verify the change through a known independent contact.
How to apply the framework
Create a no-exception beneficiary-change process and separate initiation from approval.
Monitor mailbox forwarding rules, impossible travel, new devices and unusual invoice language.
Operating workflow
Define the real process before selecting the legal label
Identify the people, data, systems, purpose, owner, processor, user journey and failure scenario. Review request, identity and transaction together. A policy statement or vendor assurance cannot replace evidence of how the live product behaves.
Separate current obligations from scheduled DPDP controls
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative CERT-In, banking, telecom, insurance, employment, consumer, contract and criminal-law requirements. Build the scheduled DPDP workflow now, but do not describe a future provision as already enforceable.
Test and preserve evidence
Run the workflow in the live or controlled test environment. Preserve screenshots, approvals, logs, vendor responses, user communications, exceptions and remediation. Assign a named owner and completion date to every failed control so management can distinguish an operating safeguard from a policy intention.
Action checklist
- Use dual approval.
- Verify bank changes out of band.
- Protect email with MFA and domain controls.
- Pause urgent exceptions.
- Contact bank immediately after fraud.
- Preserve headers and access evidence.
Evidence to keep
- Payment workflow
- Callback record
- Email headers and login logs
- Bank beneficiary and transfer record
- Cybercrime/CERT-In complaint
Warning signs
- Secret urgency
- New bank in old thread
- Approval by reply email
- One person can create and release payment
- Mailbox forwarding rule
Finin2min takeaway
Privacy and cyber maturity are visible in operating behaviour: what the organisation collects, who can use it, how vendors are controlled, how users exercise choices, how incidents are handled and whether evidence survives scrutiny.