A message from executive management requests an urgent transfer, a supplier reports new bank details, or HR asks for sensitive data. Such emails often appear convincing because the tone, names and ongoing projects are correct. Generative AI makes it easier for attackers to craft error‑free, appropriate texts. The same technology can help employees sort warning signs. However, it must not take over the decision. The most effective protection remains a clear process that verifies identities via a second channel and removes the time pressure from the situation.
This guide shows how Austrian businesses can use AI as a cautious analysis aid without copying confidential messages into external systems. The focus is on Business Email Compromise (BEC) and the decisions that people must make themselves. The goal is not to automatically block every unusual message. It is about reliably detecting, stopping, and processing risky payment and data requests in a traceable way.
Why Business Email Compromise is so convincing
BEC is not a single piece of malware, but a family of scams. Criminals pose as a known executive, a supplier, or a colleague. Sometimes only a sender address is spoofed. In other cases, a real mailbox is compromised. Then the signature, earlier conversation threads, and internal wording match particularly well. According to "CERT.at Corresponding reports from Austrian organizations have recently become more frequent.
The attack exploits human routines more than a technical vulnerability. Typical levers are urgency, confidentiality, authority, and a seemingly small deviation from the normal procedure. A new IBAN, an unusual gift card order, or a request to show the transaction to no one is meant to prompt employees to act quickly. Generative AI can create convincing variants in good German and incorporate publicly available information about roles or projects. Perfect grammar is therefore no longer a reassuring sign.
What an AI check can do – and what it cannot
An internally approved AI system can structure the content of a message according to defined patterns: Is a payment being requested? Is a bank account being changed? Is artificial time pressure being created? Is an established approval process being bypassed? Is there a request for passwords, personnel data, or confidentiality? Such an analysis is useful when it appears as an indication and not as a final judgment. Legitimate emails can also be unusual, and sophisticated attacks can be phrased inconspicuously.
Employees should never copy complete suspicious emails, including names, addresses, billing details, or attachments, into a publicly available AI tool. That can disclose trade secrets and personal data. Only a company‑vetted service with clarified contracts, storage rules, and access controls is permissible. Often a local checklist without AI is sufficient. The WKO guideline on legal framework conditions emphasizes data protection, third‑party rights, and the prompt reporting of serious errors.
The secure review process in seven steps
- Stop the action: Do not respond yet, do not open any links, do not open any attachments, and do not initiate any payment.
- Identify the request: Geht es um Geld, Zugangsdaten, neue Stammdaten, vertrauliche Dokumente oder eine Umgehung des normalen Prozesses?
- Check the sender technically: Tatsächliche Adresse, Antwortadresse und Domain genau lesen. Anzeigename oder Firmenlogo sind kein Identitätsnachweis.
- Cross-check context: Passt die Bitte zu Bestellung, Vertrag, Betrag, Termin und üblicher Rolle? Abweichungen schriftlich festhalten.
- Use a second channel: Die angeblich anweisende Person über eine bereits bekannte Telefonnummer oder einen internen Kanal kontaktieren – nie über Kontaktdaten aus der verdächtigen Nachricht.
- Apply the four-eyes principle: Finanztransaktionen und Stammdatenänderungen werden von zwei getrennten Personen geprüft. Eine Person soll nicht zugleich anlegen, freigeben und ausführen.
- Report the incident: Die Nachricht an die interne IT- oder Sicherheitsstelle weitergeben, damit ähnliche Mails, Regeln und betroffene Konten geprüft werden.
This procedure follows the practical recommendations of CERT.at. It prevents an AI score from being understood as a convenient substitute for identity verification. A model may, for example, indicate "high risk" and state reasons. Approval or rejection remain with named individuals who know the business context.
A concrete example from accounting
An employee at a Salzburg company receives an email from a trusted supplier on a Friday afternoon. The invoice appears familiar, but the bank details are said to need immediate change due to a "system migration." An internal checking tool flags three indicators: new payment details, unusual urgency, and a deviation from the previous communication channel. That is not yet proof of fraud. The employee calls the phone number stored in the master data system and learns that no change was requested.
The crucial protection was not the AI, but the interplay of the alert, a known callback channel, and the locked master data change. If the model had failed or had classified the email as unremarkable, the same process would have to apply. That is why control steps belong in the work instructions and not only in a technical product.
Design prompts without confidential data
When a shared system is used for text analysis, the task should be narrowly specified. Instead of „Is this email real?“ a verifiable instruction is more useful: „Classify the anonymized text into the categories payment request, master data change, time pressure, confidentiality, access credentials and process deviation. Cite only the passages that justify your classification. Do not make a payment decision.“ Names, account numbers, phone numbers, signatures and project details are removed beforehand if they are not required for the analysis.
The result should not be placed unreviewed in a personnel file or a performance review. Those who report suspicious messages act with security awareness and must not be disadvantaged for a false alarm. Training should show that even experienced employees can be deceived. A good reporting culture rewards stopping early and asking questions.
Technical measures that support the work process
The best text analysis is of little use if accounts are accessible without multi-factor authentication or external forwards go unnoticed. CERT.at recommends modern MFA, rules against unusual access as well as SPF, DKIM and DMARC for your own domains. Automatic forwards to external addresses should be restricted and monitored. The current overview from WKO zur IT-Sicherheit consolidates further protective measures for Austrian companies.
Permissions must also fit the role. Not everyone who receives an invoice should be able to change supplier master data. Payment preparation and payment approval should be separated. Logs must show who initiated, reviewed and approved a change. These organizational controls are robust against new text variants, while purely language-based filters can always be bypassed.
How teams train realistic scenarios
Awareness training is effective when it reflects real roles and workflows. Accounting practices a changed IBAN, an assistant practices an allegedly confidential instruction, HR an urgent request for employee data, and procurement a new delivery address. Each exercise ends with the same question: Which known secondary channel confirms the identity? The WKO guidance on phishing remind people not to disclose confidential data in response to unexpected messages and to use regular login channels.
AI can generate variants for internal exercises, but only with fictional people, amounts, and companies. Real customer data or real access credentials do not belong in training prompts. It must also be clear that this is an exercise and how results will be used. The goal is behavioral security, not the covert evaluation of individual employees.
What to do after a click or a payment
A mistake must not be covered up. After a click, a password entry, or a transfer, speed matters. Affected persons should report the incident immediately, disconnect the device from the network if necessary, change access credentials via a clean channel, and inform the bank as well as internal responsible parties. IT checks sessions, redirects, MFA registrations, and other recipients. Evidence is secured without reopening suspicious files.
If personal data is affected, the company must assess the risk. The österreichische Datenschutzbehörde beschreibt, wann eine Meldung erforderlich ist und welche Angaben sie enthalten muss. Eine mögliche Frist läuft nicht erst dann, wenn alle Details bekannt sind. Deshalb gehören Datenschutz, IT-Sicherheit, Rechtsberatung und Geschäftsführung in einen vorab definierten Eskalationsweg. Ergänzend hilft der bestehende JobSpot-Leitfaden zum Handling AI incidents in the company.
How an AI alert remains auditable
A useful alert doesn't just show a traffic-light color. It specifies the detected indicators, the relevant text excerpt and the limits of the claim. "High urgency and request to change payment details detected" is verifiable. "Fraud with 96 percent probability" sounds precise, although the number means little without appropriate test data. Teams should therefore define which specific indicators always trigger a manual review. These include new bank details, unusual payees, deviating domain names, confidential special channels and requests to bypass controls.
Before deployment the system is tested with fabricated examples drawn from the company's own processes. The test contains real business situations without real personal or account data: a legitimate rush order, an announced supplier change, a forged executive instruction and a compromised conversation thread. Measurement is not only about how many attacks are detected. It is also important how many normal processes are stopped unnecessarily and whether employees understand the explanations. Thresholds are then adjusted, documented and regularly re-evaluated.
Changes to the model, rules or data sources require a version identifier. If an alert is later investigated, it must be possible to see which configuration was in effect. At the same time, the company should log as little email content as possible. Usually, event type, timestamp, detected risk indicators and the process decision taken are sufficient. Complete messages should be stored in a protected case archive only when required for investigation or legal obligations.
Roles and escalation in Austrian SMEs
Even small businesses don't need a complicated control center, but they do need clear roles. Employees report suspicious requests to a known address or telephone number. A designated person checks the mail account and technical indicators. Accounting stops payments, procurement blocks master-data changes, and management decides on external communications. Data protection officers assess possible personal-data references. If external IT service providers are involved, availability, responsibility and secure handover procedures must be agreed before an incident.
A simple escalation matrix can distinguish three levels. Level one covers a suspicious, not-yet-executed request: report, verify, confirm the sender. Level two applies when credentials have been entered or an attachment has been executed: secure the account, isolate the device, review logs. Level three concerns payments, data exfiltration, or a compromised administrative account: activate the incident response team, contact the bank and, if applicable, authorities, assess the data protection risk, and continuously document decisions.
For shift and part-time teams the process must also work outside normal office hours. An instruction from management in the evening must not go unchecked simply because the usual approver is unavailable. The safe rule is: wait or escalate to a designated deputy. No genuine business transaction should require employees to secretly bypass a central control.
Five questions before any payment or data change
A short card at the workplace is often more effective than a long guide. First: Does the request match the known order? Second: Has a bank account, address, or role been changed unexpectedly? Third: Am I being asked to act unusually quickly or confidentially? Fourth: Can I confirm the identity via an already known channel? Fifth: Has a second authorized person reviewed the transaction? Even a single unresolved “no” or warning sign is enough to stop.
AI can display these questions in the mail client and pre-sort available information. However, it should not invent an answer when data is missing. “Unknown” is a valuable result. The system must also not simulate a call or independently adopt new contact details from the suspicious email. Verification means using an independent source: an approved supplier directory, an existing contract, or the internal address book.
Checklist for a resilient BEC process
- For payment and master data changes, there is a documented call-back procedure with pre-established contact details.
- The four-eyes principle and segregation of duties are implemented both technically and organizationally.
- MFA, email domain protection, and forwarding rules are regularly checked.
- AI analysis only uses approved systems and content that is anonymized as much as possible.
- The model provides reasons and uncertainty, but no automatic approval.
- Employees are aware of a simple reporting point and are not sanctioned for false alarms.
- There are separate emergency cards for account compromise, payments, data leakage, and data protection reporting.
Conclusion: Trust requires a second channel
AI can make suspicious patterns visible, explain phrasing, and structure the initial review. However, it can neither confirm the identity of an executive nor fully know the business context. Austrian companies gain security when they combine technical indicators with a call-back, the four-eyes principle, clear permissions, and an open reporting culture. Those who stop under time pressure and check via a known channel are acting professionally — even if the message later proves to be genuine.
AI note: This post was created with AI as a structuring drafting aid and was editorially reviewed. For concrete security, data protection, or legal questions, the appropriate specialist departments should be involved.
