Call-back verification is the right last line. One earlier layer worth adding: many BEC emails come from lookalike domains (one swapped character), so flagging mail from domains already known for phishing or brand impersonation stops a chunk before anyone has to make a call.

WhoisFreaks' Threat Intelligence Feed includes a daily phishing/impersonation domain list: whoisfreaks.com/products/threat-intelligence-feed