A useful business email compromise (BEC) tabletop is not just an email-phishing discussion. It should put real business decisions under time pressure: money may already be moving, an executive or vendor identity may be compromised, evidence can disappear, and finance, security, legal and leadership may need to act at the same time.
What a BEC exercise should test
The exercise should test how quickly the organization recognizes financial risk, verifies a payment request through an independent channel, contacts the financial institution, contains compromised identities or mailboxes, preserves evidence, coordinates external reporting and communicates with decision-makers.
The FBI recommends independently verifying payment or account changes and, when fraud has occurred, contacting the financial institution immediately. That makes elapsed time a meaningful part of a BEC tabletop rather than decorative scenario detail.
Six practical BEC scenarios
1. Vendor bank-detail change / invoice fraud
Accounts Payable receives a legitimate-looking message in an existing vendor conversation announcing new banking details. A large invoice has already been paid. Test who independently verifies the change, how the bank is contacted, how the vendor relationship is validated and how related payments are reviewed.
2. CEO or CFO urgent wire impersonation
An executive appears to request an urgent confidential transfer and pressures the employee to bypass normal approval. Test whether urgency or authority defeats the payment-control process and how the team escalates when the request appears to come from senior leadership.
3. Compromised executive mailbox
The message is not merely spoofed: an attacker has access to a real mailbox and legitimate conversation history. Test identity containment, session/token revocation, forwarding-rule review, evidence preservation, payment exposure and communications.
4. Payroll/direct-deposit diversion
An employee or executive appears to request a bank-account change shortly before payroll. Test independent verification, HR/payroll controls, scope analysis and the response if funds have already been deposited to the fraudulent account.
5. Attorney or real-estate payment diversion
Payment instructions change late in a transaction involving counsel, a title company or another trusted party. Test how the organization validates the change using previously established contact information rather than contact details supplied in the suspicious message.
6. AI voice plus email authorization
An email request is reinforced by a convincing voice call or voicemail purporting to be an executive. The goal is not to debate whether the media is “really AI”; it is to test whether the payment process depends on identity signals that can be imitated and whether independent verification survives pressure.
Put money and time on the screen
Give the team a realistic amount at risk and the time since transfer. Every meaningful decision should consume simulated time. Track whether the bank or fraud team has been contacted, whether the vendor or executive has been independently verified, whether the mailbox is contained and whether evidence is preserved.
Include the right roles
BEC crosses organizational boundaries. Depending on the scenario, participants may include Finance or Accounts Payable, CFO leadership, procurement, HR/payroll, IT/security, legal/compliance, communications and executive leadership. The exercise is stronger when participants make the decisions they would own in a real event.
Decisions worth practicing
- Who contacts the financial institution, and with what information?
- How are payment instructions independently verified?
- When is a mailbox or identity considered contained?
- What evidence must be preserved before remediation changes it?
- How far back should related payments and mailbox activity be reviewed?
- Who decides whether customers, vendors, insurers, counsel or law enforcement must be contacted?
- Which payment controls need immediate corrective action?
End with corrective actions
Record the event timeline, financial-escalation timing, verification decisions, identity-containment actions, evidence gaps and payment-control weaknesses. Assign owners and due dates to improvements. The exercise is valuable only if the lessons change how the organization operates.
Run these scenarios interactively
Business Email Compromise Tabletop Pro includes six BEC and wire-fraud scenarios, funds-at-risk and elapsed-time tracking, role-based decisions, financial escalation, identity containment, evidence preservation and an after-action report.
View BEC Tabletop Pro on Etsy — $49References
Further reading: FBI Business Email Compromise guidance and NIST incident-response preparation resources for tabletop exercises and after-action improvement.