Version 1.0Updated Sep 05, 2026

Business Email Compromise Response Protocol

A coordinated response protocol for mailbox takeover, payment diversion, fraudulent instructions, and related identity compromise. The document provides clear ownership, decision thresholds, implementation steps, evidence expectations, and a repeatable review cadence so teams can apply the guidance consistently under operational pressure.

becemailfraudidentity

Inside the document

01Activation and verification
02Mailbox containment
03Payment recall coordination
04Identity recovery
05Stakeholder communications

Built for accountable execution

A coordinated response protocol for mailbox takeover, payment diversion, fraudulent instructions, and related identity compromise.

Included operating aids

Defined owners and decision points
Practical validation and evidence prompts
Escalation and exception guidance
A repeatable review and improvement cadence