Which most likely indicates that a business email compromise attack has occurred?

Business Email Compromise (BEC) is a fraud scheme where criminals trick a company into sending money to a fraudulent account. The most common tactic involves the fraudster impersonating a known supplier or executive and providing new payment instructions. Therefore, a company sending a recurring payment to a new, previously unused account number (A) is a classic and direct indicator that a BEC attack has likely succeeded. The change in account details for an established payment is the core of the scam.

B. A company sends a larger-than-normal check to an existing supplier: This could be a legitimate business transaction for a large order and does not, by itself, indicate a BEC attack.
C. A company adds a new employee as an authorized signer: This is a routine internal administrative change and is unrelated to external fraud schemes like BEC.
D. A company has a new beneficial owner: This is a change in the company's ownership structure, which is a matter for customer due diligence, not an indicator of transactional fraud.

1. Financial Crimes Enforcement Network (FinCEN). (2019). FIN-2019-A005: Updated Advisory on Email Compromise Fraud Schemes. p. 3. "A common scenario... involves a business that has a long-standing relationship with a supplier. The fraudster... provides the business with new payment instructions to a fraudulent account."

2. ACAMS. (2022). Financial Crimes Investigations (FCI) Study Guide. Chapter 3: Investigating Specific Financial Crimes. The guide explicitly describes BEC attacks as involving "fraudulent payment instructions" that redirect funds to accounts controlled by criminals.

3. The Wolfsberg Group. (2020). Statement on Fighting Financial Crime. The statement highlights the rise of cyber-enabled fraud, including BEC, where social engineering is used to "induce a legitimate user to conduct an unauthorised payment."