Call-back verification is the right last line. One earlier layer worth adding: many BEC emails come from lookalike domains (one swapped character), so flagging mail from domains already known for phishing or brand impersonation stops a chunk before anyone has to make a call.
WhoisFreaks' Threat Intelligence Feed includes a daily phishing/impersonation domain list: whoisfreaks.com/products/threat-intelligence-feed
Ali Tahir
Domain security, DNS data, and phishing infrastructure
Call-back verification is the right last line. One earlier layer worth adding: many BEC emails come from lookalike domains (one swapped character), so flagging mail from domains already known for phishing or brand impersonation stops a chunk before anyone has to make a call.
WhoisFreaks' Threat Intelligence Feed includes a daily phishing/impersonation domain list: whoisfreaks.com/products/threat-intelligence-feed