---
name: rt-exploit-bec
description: "Business Email Compromise awareness and process-control assessment skill. Requires explicit SEAD authorization and focuses on verification workflows, payment-change resilience, executive impersonation resistance, and remediation."
---

# rt-exploit-bec - Business Email Compromise Simulation

> This skill is for authorized control assessment only. Do not use real bank details, live fraud infrastructure, or deceptive production-ready templates.

## Overview

BEC testing evaluates whether business processes resist impersonation, urgency pressure, payment redirection, payroll-change requests, and executive authority abuse. The finding is usually not "a user clicked"; it is "the process allowed a high-risk request without independent verification."

## Prerequisites

- SEAD explicitly authorizes BEC simulation.
- Approved target departments and sample size.
- Approved sender identity and disclaimers.
- No real funds, payroll, vendor, or customer changes.
- Client escalation contact and stop phrase.
- Post-test notification plan.

## Scenarios For Approval

| Scenario | Control Tested | Sensitive Action Must Be Simulated |
|---|---|---|
| Vendor bank detail change | Accounts payable verification | Yes |
| Payroll direct deposit update | HR identity verification | Yes |
| Executive urgent purchase | Authority challenge process | Yes |
| Invoice approval pressure | Finance dual approval | Yes |
| M&A confidentiality request | Legal/comms escalation | Yes |

## Workflow

1. Define business process and control objective.
2. Draft simulation artifact with clear internal test tracking.
3. Obtain client approval for text, timing, recipients, and success criteria.
4. Execute through approved platform or mailbox.
5. Measure response: reply, escalation, verification, reporting, unsafe compliance.
6. Debrief client and produce process-level recommendations.

## Evidence

Capture:

- Approved scenario.
- Recipient group count.
- Timeline.
- Responses by category.
- Whether out-of-band verification occurred.
- Whether the event was reported.

Do not publish employee names in executive summaries.

## Remediation

- Require callback verification to known numbers.
- Add payment-change workflows with dual approval.
- Harden display-name spoofing controls.
- Enforce DMARC reject where possible.
- Train finance/HR/executive assistants with process-specific examples.
- Add easy suspicious-email reporting.

## Autodoc

```bash
python _rtexit/scripts/autodoc_engine.py log --skill rt-exploit-bec --phase exploitation --cmd "authorized BEC simulation" --output "summary metrics only"
```

