Business email compromise: how the invoice fraud actually works

How the attack unfolds

It starts with access. A phishing page harvests credentials, or an adversary-in-the-middle kit captures a session cookie after a legitimate MFA approval. Either way the attacker now reads a real mailbox — often that of a finance manager, an office manager, or a director.

Then they wait. This is the part people find hardest to believe. The attacker reads months of correspondence, learns the names of suppliers and clients, notes the payment terms, observes how the business writes emails, identifies who approves payments and who never questions them, and finds out when the finance person takes holiday. They set an inbox rule to move messages containing words like 'invoice', 'payment' or 'bank' into an obscure folder, so the genuine recipient does not see the thread they are about to hijack.

Finally they intervene. A real invoice conversation is already running. The attacker replies within it — from the genuine account, in a thread the recipient started, in the sender's ordinary writing style — saying the bank details have changed, perhaps citing an audit or a new account. The payment is made to the attacker. Nobody notices until the real supplier chases the unpaid invoice, typically weeks later, by which point the money has been moved on.

Why technical controls do not stop it

SPF, DKIM and DMARC verify that a message genuinely came from the domain it claims. In a BEC attack it did. The email passes authentication because it is authentic — it was sent from the legitimate mailbox by someone who should not be in it.

Spam filtering does not help either, because the message contains no attachment, no suspicious link and no malicious payload. It is a sentence about bank details in a thread that has been running for a fortnight. There is nothing for a filter to detect.

This is why BEC defence is procedural first and technical second. The technical measures reduce the chance of the mailbox being compromised in the first place and shorten how long an intruder can hide; the procedure is what stops the money leaving.

The control that actually works

Any change to bank details — from anyone, in any circumstances — is verified by a voice call to a number already held on file, never a number in the email requesting the change. No exceptions for urgency, no exceptions for the managing director, no exceptions for a long-standing supplier.

Write this down as a policy, tell suppliers you operate it so they expect the call, and — critically — tell staff explicitly that they will never be criticised for delaying a payment to make the verification call. Most BEC losses in small businesses happen because a junior employee did not feel able to question an instruction that appeared to come from a senior person under time pressure. Authority and urgency are the entire attack.

Add a second person's approval for payments above a threshold you choose, and require it particularly for new payees and changed details. Two people rarely make the same mistake under pressure.

• Verify every bank detail change by voice, using a number already on file
• Require dual authorisation for new payees and for changed details
• Tell suppliers you operate this policy so the callback is expected
• Explicitly authorise staff to delay payment to verify, in writing
• Treat urgency in a payment request as a warning sign, not a reason to hurry

Reducing dwell time with mailbox controls

The attacker's advantage is time. Everything that shortens their observation window reduces the quality of the eventual attack, and several of these controls are free.

Block automatic external forwarding at the tenant level — this is default behaviour in Exchange Online's outbound spam policy, but it is often turned off for a legitimate-sounding reason and never restored. Alert on the creation of new inbox rules, particularly rules that forward externally or move messages to rarely-used folders. Enable and understand your audit log before you need it. Use impersonation protection in Defender for Office 365 for your highest-risk names.

And enforce phishing-resistant MFA for finance staff and administrators. Passkeys and FIDO2 keys defeat the adversary-in-the-middle attack that increasingly delivers the initial access.

The first hour after you realise

Speed matters more than diagnosis. Call your bank's fraud line immediately and ask them to attempt recall — the realistic window is short, and funds are commonly moved onward within hours. Contact the receiving bank as well if you can.

In parallel, contain the account: reset the password, revoke all sessions, remove any MFA methods the attacker registered, delete inbox rules they created, and review OAuth application consents. Preserve evidence before you clean up — export the mailbox audit log and the rules rather than simply deleting them.

Then report to Action Fraud, notify anyone whose data may be affected, and check whether the mailbox contained personal data, because a UK GDPR notification assessment may be required within 72 hours. Tell your insurer early; late notification is a common reason for claims being reduced. Finally, warn your suppliers and clients — an attacker inside your mailbox has been reading their correspondence too.