Business email compromise is one of the costliest forms of cybercrime for small businesses, and it rarely involves sophisticated hacking. An attacker gains access to a mailbox, or creates a look-alike address, watches real conversations, and then sends a convincing request to change bank details or pay an “urgent” invoice. The money is gone within hours.
Businesses that handle large, regular payments are frequent targets. That includes contractors with draws and subcontractor payments, farms paying for inputs and receiving settlements, associations paying venues and vendors, and accounting firms handling client funds or payroll.
The single most effective control
Verify every change to payment details by phone, using a number you already have on file, not one from the email. Make it a written rule with no exceptions for urgency or seniority. Most attacks fail at this step.
Add a second person for large payments
Require a second approver for payments above a threshold and for any new payee. Attackers rely on one busy person acting quickly.
Secure the mailboxes
- Turn on multi-factor authentication for every email account.
- Disable accounts of departed staff promptly.
- Check for unexpected forwarding rules, a common sign of a compromised mailbox.
- Use email authentication records for your domain so others cannot easily impersonate it.
Teach the warning signs
Short, regular training beats an annual lecture. The classic signs are:
- A request to change bank details, especially near a payment date.
- Unusual urgency or secrecy, such as “don’t call, I’m in a meeting.”
- A slightly different sender address or reply-to address.
- An invoice that is almost, but not exactly, like the usual one.
Know what to do if it happens
If money has been sent to a fraudster, speed matters. Call your bank immediately and ask them to attempt a recall. Report the incident to law enforcement; in the United States, that includes the FBI’s Internet Crime Complaint Center. Secure the compromised mailbox, and notify the counterparties involved. Your incident response plan should list these steps.
Watch for AI-assisted scams
Attackers increasingly use AI to write convincing messages and even imitate voices. The phone call-back rule still works, as long as you call a number you already trust rather than one provided in the message.
Payment verification, MFA, and mailbox hardening are part of every cybersecurity engagement we run.
Written by the Syntonyl team. This article is general information, not legal, tax, or financial advice.