Several finance employees have received convincing emails, apparently from a long-time supplier, asking them to update the supplier's bank account details before the next invoice is paid. Which awareness topic should targeted training for this group emphasize?

Business email compromise uses compromised or spoofed email accounts, often belonging to executives or trusted suppliers, to trick staff into sending money or sensitive data. Requests to change a supplier's bank details before a payment are a signature pattern because they redirect legitimate payments to an attacker's account, and the messages often contain no malware or links for technical controls to catch. Targeted training for finance staff should explain the pattern and require out-of-band verification, meaning a call to a contact number already on file rather than one in the email, plus dual approval for any change to payment details. Removable media training addresses malware and data loss through USB drives and cables; it is important but irrelevant to fraudulent payment-change requests. Password management training reduces account compromise within the organization, but the fraudulent emails here come from the supplier's side or a spoofed domain, so stronger internal passwords would not stop the payment diversion. Situational awareness training addresses physical surroundings, such as tailgating and shoulder surfing; it does not cover email-based payment fraud. Exam caveat: BEC exploits process weaknesses, so pair training with a documented verification procedure. Operational check: confirm the vendor master-data change process requires a recorded call-back to a known number and a second approver.