A practical business email compromise checklist for remote teams: vendor verification, payment approvals, MFA, mailbox hardening, and incident drills.