How finance and payments teams can stop business email compromise
To stop business email compromise, never let an email alone change where money goes. Confirm every new bank account and every changed wiring instruction by calling a number you already had, require a second approver for large or changed payments, and publish DMARC at p=reject on your own domains. Americans reported $3.05 billion in business email compromise losses to the FBI in 2025, most of it through fake invoices, changed vendor bank details and spoofed closing instructions.
The Trust Identity Protocol (TIP) by The AI Lab lets the people who send payment instructions sign them in the webmail they already use. Each signature needs a fresh face or fingerprint check on the signer's own device, and the record seals who the email was sent to. The person paying opens the Verify link and checks that the instruction is exactly what a verified person signed, for them. A lookalike domain, a fake display name or a hacked mailbox cannot produce that signature.
The problem
How business email compromise reaches the payment
| Where | What goes wrong |
|---|---|
| Changed vendor bank details | An email that appears to come from a supplier asks for future payments to go to a new account. |
| Spoofed closing instructions | Homebuyers receive new wiring instructions from a fake or hacked title company or attorney account. |
| Executive impersonation | A message from the "CEO" or "CFO" asks for an urgent, confidential transfer. |
| Hacked supplier mailbox | A real account sends a real-looking invoice inside a real thread, and passes every domain check. |
Every option, honestly
What each option does, and where it stops
These work together. Use more than one, and read the last column for each, including ours.
| Option | What it does | Where it stops |
|---|---|---|
| Callback and dual approval | Confirm payment changes on a known number and require a second approver. | Depend on staff following them under time pressure. |
| SPF, DKIM and DMARC at p=reject | Stop forged mail that uses your exact domain. | Do not address lookalike domains, fake display names or hacked mailboxes (RFC 7489). |
| Email security gateways | Filter known phishing, malware and suspicious senders. | Struggle with a well-written request from a real or lookalike account. |
| Bank account validation services | Check that an account belongs to the named payee, where available. | Coverage varies by country and bank. |
| Trust Identity Protocol (TIP) by The AI Lab | Lets verified people sign payment emails in webmail, each signature needing a fresh biometric on their device, with the recipients sealed into the record. Checking is free. | Does not block mail or stop a person being tricked. It gives your rule a check that a lookalike or a hacked mailbox cannot pass. |
Step by step
How to put it in place, in order
- Write the rule: no email alone can change bank details or authorize an urgent transfer.
- Give the people who send payment instructions TIP-IDs and the free TIP extension.
- Sign every invoice, change of bank details and wiring instruction with TIP.
- Tell vendors and customers to treat any unsigned payment email from you as unconfirmed and call.
- Keep callback, dual approval and DMARC at p=reject in place, and report any attempt to your bank and to ic3.gov.
About TIP
What the Trust Identity Protocol is
The Trust Identity Protocol (TIP) is an open standard from The AI Lab for proving who made a piece of content and whether it has changed. A person or organization is verified once by an accredited Verification Provider and gets a TIP-ID. Each time they sign something, their own device signs it with a post-quantum signature (ML-DSA-65, NIST FIPS 204) after a fresh fingerprint or Face ID, and the TIP Network records the signature, the time, an origin label and a fingerprint of the content. Anyone can check a record for free, with no account.
TIP does not detect deepfakes, does not stop copying and does not decide whether content is true. It proves who stands behind a piece of content and whether a copy matches the original. It is governed in the open by the AI Trust Council, and the specification is public on GitHub. Signed content is called a Verifiable Asset.
Questions
Questions people ask
What is business email compromise?
Fraud that impersonates a boss, supplier, lawyer or title company by email to redirect a payment. It usually involves no malware, which is why spam filters miss it. The full guide, with documented cases, is at theailab.org/email-spoofing-protection.
Does DMARC stop business email compromise?
Only part of it. DMARC at p=reject stops forged mail that uses your exact domain. Its own standard says it does not address lookalike domains or display names, and mail from a hacked real mailbox passes it. Those are how most large losses happen.
How do we verify a vendor's new bank account?
Call the vendor on a number already in your records, confirm the details with someone you know, require a second approver, and send a small test payment first. If your vendors sign payment emails with TIP, the change also has to pass a signature check a lookalike domain cannot fake.
What do we do if we already paid a fake invoice?
Call your bank at once and ask it to recall the payment, then file at ic3.gov in the United States or with your national cybercrime service. In 2025 the FBI froze $679 million, 58% of the money at risk, in the fraudulent transfers reported to it quickly.
What is the Trust Identity Protocol?
The Trust Identity Protocol (TIP) is an open standard from The AI Lab for proving who made a piece of content and whether it has changed. A person or organization is verified once by an accredited Verification Provider and gets a TIP-ID. Each time they sign something, their own device signs it with a post-quantum signature, and the TIP Network records who signed it, when, how it was made (Original Human, AI-Assisted, AI-Generated or Mixed) and a fingerprint of the content. Anyone can check the record for free.
What does TIP cost an organization?
Checking any TIP record is free for everyone, with no account. Signing is free for individuals, nonprofits, schools and universities, government bodies, journalism organizations for editorial use and businesses under USD 100,000 in annual revenue. Larger businesses use a published commercial license, with every tier listed at theailab.org/tip-license.
Other use cases
Where else TIP helps
- Hiring and recruiting
- Students and academic integrity
- Certificates and credentials
- Insurance claims
- Freight and logistics
- Newsrooms and journalism
- Archives, libraries and museums
- Research publishing
- Creators and creator platforms
- Banks and finance teams
- Agencies, brands and marketing
- Referral, rewards and marketplaces
- One person, many accounts
- Documents from people you have never met
- All use cases