Some of the most expensive cyberattacks on small businesses involve no malware at all. A bookkeeper receives an email from a familiar supplier saying their bank details have changed. Or an office manager gets a short, urgent note that appears to come from the owner, asking for a payment to be sent today. The money is sent, and it goes straight to a criminal.
This is called business email compromise (BEC). The FBI has consistently ranked it among the costliest types of cybercrime reported to it, and it hits companies of every size because it targets people and processes rather than technology.
How the scam usually works
- A mailbox is taken over. Often a supplier's or a staff member's email account is accessed using a stolen password. The attacker quietly reads mail for weeks, learning who pays whom and when.
- Or an address is faked. Instead, the attacker registers a look-alike domain, such as one letter changed, or simply sets a familiar display name on an unrelated address.
- The request arrives at the right moment. Because the attacker has been watching, the fake invoice or the "updated banking details" email often matches a real, expected payment.
- Pressure is applied. Urgency, secrecy or authority is used to discourage the normal checks: "I'm in a meeting, just get this done before the end of the day."
The single most effective control: call back
Make it a firm rule that any change to payment details, and any unusual or urgent payment request, is confirmed by phone using a number you already have on file, not a number from the email asking for the change. A two-minute call to a known contact stops the large majority of these frauds. Write the rule down, tell suppliers you follow it, and make sure staff know they will never be blamed for slowing a payment down to check.
Other process controls
- Two-person approval for new payees, changed bank details and payments above a set amount.
- Hold periods for changed details. A short delay before paying a newly changed account gives time to verify.
- Never act on "keep this between us". Requests to bypass normal procedure are a warning sign in themselves.
Technical protections that help
- Multi-factor authentication (MFA) on every email account. Most mailbox takeovers start with a stolen password, and MFA blocks most of those attempts.
- Email authentication. Set up SPF, DKIM and DMARC records for your domain. They make it much harder for criminals to send email that appears to come from your exact address.
- External sender warnings. Configure Microsoft 365 or Google Workspace to label messages from outside the organization, which makes a fake "internal" email stand out.
- Watch for forwarding rules. Attackers often create hidden inbox rules that forward or delete messages. Alerts for new forwarding rules catch a compromised mailbox early.
- Training. Short, regular awareness training helps staff recognize pressure tactics and look-alike addresses.
If a payment has already been sent
Speed matters more than anything else. The sooner the banks are involved, the better the chance of stopping or recovering the transfer.
- Call your bank immediately and ask them to recall the payment and contact the receiving bank.
- Report it to the FBI's Internet Crime Complaint Center at ic3.gov.
- Change the password and review sign-ins on any mailbox that may have been involved, and remove unexpected inbox rules.
- Warn the genuine supplier or customer, whose account may also be compromised.
- Contact your cyber insurer if you have one. Many policies require prompt notification.
Getting help
We help organizations across Los Angeles County, the Inland Empire and Ventura County lock down email and train staff, through email security, Microsoft 365 configuration and cyber awareness training. If you think a mailbox has been compromised, contact us and we will help you investigate and secure it.