Business email compromise produces larger single losses than almost any other category, and it defeats most technical controls because there is often nothing technically wrong with the message. It arrives from a genuine address, inside a genuine thread, written in the sender's usual style, because the attacker has been reading that mailbox for weeks.

The sequence

An account is compromised, usually through phishing or a reused password. The attacker sets quiet mailbox rules to hide their activity, then reads. They learn who authorises payments, which suppliers are mid-invoice, when the finance lead travels, and how people write. At the right moment they reply within an existing thread with updated bank details, or send an urgent request to someone who would not question it.

Variants that recur

  • Supplier invoice with changed payment details, sent from the supplier's own compromised account.
  • Executive request for an urgent transfer, timed to a period when verification is awkward.
  • Payroll diversion: an employee emails HR asking to update their bank account.
  • Conveyancing and escrow interception, where a single large transfer is expected.

The one control that works

Any change to payment details is verified by voice, on a number you already held — never a number in the email, and never by replying to the thread. Make this a rule that applies without exception, including when the request appears to come from the person who set the rule. Exceptions granted under pressure are how the control fails.

Other controls worth having

  • Phishing-resistant multi-factor authentication on email for everyone, not just finance.
  • Alerting on new mailbox forwarding rules and on sign-ins from unusual locations.
  • Dual authorisation above a threshold you define, with the second approver verifying independently.
  • External-sender banners, plus SPF, DKIM, and DMARC configured to reject rather than merely monitor.

If a payment has already gone

Speed is everything. Call your bank immediately and ask for a recall to the beneficiary bank — the funds may still be sitting there for a short window. Report to your national fraud body the same day. Then treat it as an intrusion, not just a payment error: reset credentials, revoke sessions, inspect mailbox rules across all accounts, and establish when access began, because anything read during that period should be considered exposed.

Tell your suppliers and customers

If your mailbox was the compromised one, the attacker has your contact list and your threads. Warning counterparties quickly is uncomfortable and materially reduces onward losses — and those losses, if they occur through your compromised account, become your commercial and reputational problem too.