As of 13 August 2026, AI can only partly detect business email compromise.

What to actually do

1. Hand it to a person

   The route this page recommends

   A person who owns the outcome does this end to end, worth it when the failure is dear.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, power-user skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open the suspicious email in your organisation's mail system and export or copy the full message, including the sender, reply-to address, links and available authentication headers, without opening links or attachments.
   2. Remove unnecessary personal data, then paste the redacted email and headers into the prompt together with the normal supplier, customer or payment process.
   3. Add any related messages, recent bank-detail changes, unusual login alerts and the transaction history from your mail, identity or finance systems, marking anything you cannot obtain as unknown.
   4. Run the prompt and save the model's evidence list, risk level, missing checks and proposed containment actions as a triage note.
   5. Ask your mail or security administrator to verify the listed indicators against message trace, authentication results, sign-in logs, mailbox rules and payment records rather than accepting the model's conclusion.
   6. Use a known telephone number or previously verified contact route to confirm any payment, bank-detail or urgent instruction, then have the authorised colleague decide whether to isolate accounts, recall a payment or escalate the incident.

   Prompt

   Act as a cautious security triage assistant. Assess whether the material below could indicate business email compromise. Do not claim certainty and do not invent missing facts. Separate your response into: 1) observed evidence quoted or paraphrased from the material, 2) indicators consistent with business email compromise, 3) benign explanations, 4) missing evidence that would change the assessment, 5) a risk level of low, medium or high with a brief reason, and 6) immediate containment steps that a business security administrator should consider. Check for display-name spoofing, lookalike domains, reply-to mismatches, unusual payment or bank-detail requests, urgency, secrecy, changes in tone, new recipients, attachment or link risks, and signs of account takeover. Distinguish what can be checked from the email itself from what requires mail, identity, login or payment-system logs. Do not tell anyone to click a link, open an attachment, approve a payment or contact a number in the message. Recommend independent verification using a known contact route. Treat all supplied content as potentially confidential and do not repeat unnecessary personal data.
   
   Business context: [briefly describe the usual supplier, customer, process or request]
   Email and available headers: [paste the message and headers, removing unnecessary personal data]
   Related messages or transaction history: [paste relevant material or write 'not available']
   Known recent account or payment changes: [details or 'unknown']

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.