Corporate training Guides The threats your staff face
Business email compromise (BEC) training for staff and finance teams
Business email compromise (BEC) is one of the costliest frauds organisations face. It needs no malware, just a convincing email and an employee who acts on it. The defence is a trained team and a simple, strict process.
How BEC works
The attacker either takes over a real email account, often through phishing, or creates a look-alike address. They then study how the organisation works and send a well-timed request: pay this invoice, update a supplier's bank details, send staff payroll data, or make an urgent, confidential transfer for the CEO.
Because the email looks normal and often continues a real conversation, technical filters frequently miss it. The person reading it is the last control.
Who is targeted
- Finance and accounts payable teams
- Executives and their personal assistants
- Procurement and supplier management
- HR and payroll
- Anyone who can change bank details in a system
The controls that stop it
- Verify every bank-detail change and unusual payment by calling a known number, never one in the email
- Require two people to approve payments above a set amount
- Turn on multi-factor authentication for all email accounts
- Flag external emails and look-alike domains
- Make it safe to challenge a request that appears to come from a senior person
What BEC training should include
Training should use real examples of BEC emails, walk teams through your verification rule until it is a habit, and practise saying no to pressure. Executives need to be trained too, so they support staff who challenge requests made in their name.
Related training programmes
- CyberSecure Workforce: Nigeria · South Africa · Kenya · Ghana
Frequently asked questions
Is BEC only an email problem?
No. The same scam now arrives by WhatsApp, SMS and phone, sometimes with an AI-cloned voice. Training should cover every channel.
What is the single most important control?
Verifying every bank-detail change and unusual payment request by calling a known number, never one supplied in the message.
Do you run BEC training in our country?
Yes. Paleon Training runs it in Nigeria, South Africa, Kenya and Ghana as part of CyberSecure Workforce.
Can finance teams get a dedicated session?
Yes. We can run role-specific sessions for finance, procurement and executive assistants.
Published 09/11/2026 by Paleon Training Limited. General guidance, not legal advice.
Talk to us about training your teams
Paleon Training runs corporate AI and cybersecurity training for organisations in Nigeria · South Africa · Kenya · Ghana. Start with the free readiness check, or book a consultation and we will recommend a format for your organisation.