Built by a U.S. Army combat veteran and paramedic and EMS supervisor with 20+ years in emergency healthcare · According to the FBI’s 2025 Internet Crime Report, BEC caused $3.04 billion in losses in a single year · SDVOSB Pending · SAM.gov Registered · CAGE: 1AFL4
The Problem
$3 billion a year. Average loss: $122,000.
Most organizations figure it out too late.
BEC doesn’t break into your systems. It sends a professional email, creates urgency, and waits for someone to process a payment. By the time anyone notices, the money is gone.
The Vendor Email
A trusted vendor “changes banks” and needs you to update their payment details before the next invoice. Looks normal. Sounds professional. Wrong account.
The CEO Email
Your executive needs a payment processed today. Urgent. Confidential. Don’t call. The sender’s domain has one character swapped. Nobody caught it.
The Invoice
The amount matches a real project. The invoice number is slightly off. The remittance goes to the fraudulent account from the vendor email. Payment approved.
The Gap
No written verification procedure. No callback policy. No dual approval threshold. Finance didn’t know what to do, and nobody had ever practiced it before.
What You Get
Everything needed to run the exercise
and document what you find.
Five documents. One download. Ready to run.
📋
Facilitator Guide
Step-by-step instructions to run the full exercise. Includes every inject, discussion prompts, facilitator notes, timing guidance, a pre-exercise checklist, and a hot wash structure. Read it once and you can run this for any organization.
📓
Participant Workbook
Hands-on scenarios, discussion questions, and response worksheets for every participant. Includes a BEC red flag reference sheet, payment verification checklist, finance decision matrix, and internal escalation map they keep after the exercise.
📊
After Action Report Template
Structured template to capture findings, gaps, and key takeaways immediately after the hot wash. Includes an objective performance summary with rating fields and space for up to five documented findings.
🎯
Improvement Plan
Translates findings into specific corrective actions with owners, due dates, and 30/60/90-day review checkpoints. Designed to be handed to leadership as a deliverable, not filed away.
📄
Executive Summary Template
One-page summary for senior leadership covering overall readiness ratings, top strengths, priority improvements, and recommended next steps. Everything a decision-maker needs without the full report.
📧
Fake Email Inject Pack
Four realistic exercise artifacts: a vendor banking change email, an urgent executive wire request, a corrected invoice, and a payroll direct deposit change. Ready to print and hand out or display during the exercise.
How the Exercise Works
10 injects. 3 phases. 2 to 4 hours.
A realistic BEC scenario unfolds in real time. Each inject creates a new decision point. Your team talks through what they would actually do.
| Phase | Inject / Scenario | What It Tests | Time |
|---|---|---|---|
| 1 | Suspicious Email Reported | Initial BEC detection, red flag recognition | 15 min |
| 2 | Urgent Executive Request | Executive impersonation, pressure and urgency | 15–20 min |
| 3 | Vendor Account Change | Third-party banking change validation process | 20 min |
| 4 | Invoice Manipulation | Fraudulent invoice detection and controls | 20 min |
| 5 | Validation Steps | Independent verification process, trusted contacts | 20 min |
| 6 | Finance Decision Under Pressure | Risk decision-making, payment authority | 20 min |
| 7 | Internal Communication | Escalation pathways, cross-team coordination | 15–20 min |
| 8 | Containment Actions | Incident containment, bank contact, IC3 reporting | 15 min |
| 9 | Recovery Planning | Business continuity, insurance, leadership update | 15–20 min |
| 10 | Hot Wash & Improvement | Lessons learned, owned action items, next steps | 30–45 min |
Running short on time? Combine phases 3 and 4, and 8 and 9, to run a condensed 90-minute version. Always keep the Phase 10 hot wash at full length.
Who This Is For
Any organization that processes payments by email.
Finance Teams
AP, controllers, and anyone with payment authority need to practice saying no under pressure.
Healthcare Administration
Medical practices, clinics, and health systems are high-value targets for vendor impersonation and payroll diversion.
Leadership Teams
Executives whose identities are impersonated need to understand the tactics being used in their name.
Nonprofits
Lean finance teams with limited controls are exactly what BEC attackers look for. This exercise finds those gaps first.
Municipal Government
Public entities process large vendor payments and are frequently targeted. FBI case files include $6M single-incident losses.
Schools & Universities
Education institutions face vendor fraud, payroll diversion, and grant payment fraud. Finance and admin staff need this exercise.
Inside the Package
A look at the reference tools
every participant keeps.
BEC Red Flag Sheet
●
Urgency – Pressure to act fast or skip normal process
●
Secrecy – Keep this between us, don’t loop anyone in
●
Banking Change – New ACH, wire, or routing info by email
●
Lookalike Domain – One character off from the real address
●
Phone Unavailable – Confirm by email only, don’t call
Finance Decision Matrix
Vendor banking change
PAUSE
CEO urgent wire request
VERIFY
Lookalike domain found
ESCALATE
Payment already sent
REPORT NOW
BEC Response Quick Card
1.
Stop the payment
2.
Preserve the email, do not delete
3.
Call a number already on file, not one in the email
4.
Escalate to finance leadership and IT
5.
Document the decision and timeline
6.
If money moved, call your bank immediately then report to ic3.gov
$3.04B
in BEC losses reported to the FBI in 2025 alone
$122K
average loss per BEC complaint in 2025
86%
of BEC funds move by wire or ACH, fast and hard to recover
58%
FBI recovery rate when fraud is reported within hours
Source: FBI Internet Crime Complaint Center (IC3) 2025 Annual Report
Want to understand BEC before you run the exercise?
Read: Small Businesses Are Not Ready for Business Email Compromise →Want to know exactly what a BEC tabletop exercise covers?
Read: What Is a Business Email Compromise Tabletop Exercise? →Get the Package
Find out where your gaps are
before someone else does.
Six documents. 10 injects. 2 to 4 hours. Everything your team needs to practice, identify gaps, and walk out with a real improvement plan.
Get the BEC Package – $499Instant download · Customize with your organization’s name · No facilitator experience required
Questions? michael@forwardsecuritylabs.com
Forward Security Labs · ForwardSecurityLabs.com · Built by a combat veteran and paramedic with 20+ years in emergency healthcare. Protect. Prepare. Move Forward.