: A sudden request to change payment instructions or bank account details for a known vendor is a major indicator.
If a BEC attack is suspected, investigators follow a technical workflow to determine the scope: Business Email Compromise - FBI : A sudden request to change payment instructions
: Requests that deviate from standard business procedures, such as a CEO asking an assistant to buy gift cards, are common lures. Investigating a Suspected Incident : A sudden request to change payment instructions
