01
Email forensics
Header analysis and rule tampering.
BEC
Inboxes that rewrite payment rails
BEC actors compromise email or impersonate vendors to redirect wires—increasingly into crypto wallets.
BEC with crypto
Finance teams receive altered invoices or CEO fraud messages directing urgent transfers.
Crypto adds speed once fiat is converted or when victims send stablecoins directly.
Attack sequence
- 01
Mailbox access
Phished credentials or forwarding rules hide replies.
- 02
Instruction swap
Bank details replaced with wallet addresses.
- 03
Cash-out
Funds move through OTC or exchanges rapidly.
Controls
- Dual approval bypassed via urgent language
- Domain look-alike vendor emails
- First-time crypto payment to new beneficiary
Flows
Hybrid fiat-to-crypto or direct stablecoin from corporate wallets.
- — Same-day conversion
- — Multiple beneficiary wallets
- — Mule accounts internationally
Evidence
- Original vs fraudulent emails with headers
- Wire confirmations
- Crypto TXIDs if applicable
- Callback verification records
Investigation
02
Tracing
Follow crypto leg from treasury.
Now
- 01Notify bank and law enforcement immediately
- 02Preserve mail systems before IT cleanup
- 03Implement out-of-band verification for payment changes
Never provide a seed phrase, private key, or authentication code to anyone claiming they can recover funds—including parties who contact you unsolicited. Legitimate investigators do not need wallet secrets to begin a case review.
Frequently asked questions
Can banks reverse crypto legs?
Generally not; speed makes tracing and legal process urgent.
Assess BEC crypto loss
Corporate counsel should initiate contact with payment details.