For cyber incident response plans to be successful, they should address a number of attack scenarios. A business email compromise (BEC) scam is one of the most important scenarios to include in these plans. This document provides an example of a BEC scam scenario and explains how a cyber incident response plan can help address this scenario.