Business email compromise explained

Business email compromise is consistently among the costliest attack types for Australian businesses by direct financial loss, and it is the one least addressed by security tooling. There is usually no malware, no attachment and no malicious link: just a real email, from a real mailbox, in a real conversation, asking for a payment to go to a slightly different account.

How it actually works

1. Access. The attacker gets into a mailbox, most often through a phished credential or a session cookie stolen by an infostealer, which is why MFA alone does not close this off. Sometimes no access is needed at all: a lookalike domain (acmegroup-au.com instead of acmegroup.com.au) is enough.

2. Reading, not acting. This is the part people underestimate. The attacker sits quietly for weeks, learning who approves payments, how invoices are worded, when your big projects invoice, and who is on leave. They often create an inbox rule that moves messages from a supplier into an obscure folder, so the real person never sees the thread.

3. Insertion. At the right moment they reply within an existing thread: correct signature, correct tone, correct history quoted below. “We’ve changed banks, please update our remittance details for this invoice.”

4. Pressure and timing. Chosen deliberately: end of quarter, the day before a public holiday, or while the finance manager is on leave. Urgency is the tell, and it is applied by someone who knows your calendar.

5. Extraction. Funds land in a mule account, are broken up and moved within hours. After roughly 24 hours, recovery odds fall sharply.

The common variants

Supplier invoice redirection: the costliest. A genuine invoice for a genuine amount, with changed bank details.
CEO or executive fraud: an urgent, confidential request from the boss. Smaller amounts, higher volume.
Payroll diversion: an employee “updates” their bank details just before a pay run. Small individually, and often missed for a full cycle.
Conveyancing and settlement fraud: property settlement funds redirected. Australian buyers have lost entire deposits this way, often unrecoverable.
Vendor onboarding fraud: fraudulent details supplied when a supplier is first set up, so there is no “change” to detect at all.

Why technical controls miss it

SPF, DKIM and DMARC are worth deploying. They stop your domain being spoofed outright, and they should be on strict enforcement. But they do nothing about the main case, because the email is genuine. It passes authentication because it is authenticated. It comes from a mailbox that legitimately belongs to your supplier.

That is the whole insight: BEC is a process failure, not a filtering failure. You cannot buy your way out of it, and the controls that work are unglamorous.

The controls that actually work

Callback verification, on a known number. Any change to bank details is verified by phone, using a number from your own records, never a number in the email requesting the change. This single control stops most BEC, and it is free.

Make it a rule, not a judgement. “Verify if it seems odd” fails, because the whole design of the attack is to not seem odd. It has to be: every bank-detail change is called back, no exceptions, no seniority override. Staff must be explicitly told they will never be criticised for delaying a payment to verify it. Most successful BEC relies on someone not wanting to question an executive.

Dual authorisation above a threshold, by two people who both know the callback rule.

Monitor for inbox rules. Auto-forwarding to external addresses, and rules that move mail from a supplier into an unused folder, are a strong signal of a compromised mailbox. Alert on their creation.

Phishing-resistant MFA on email, plus short session lifetimes so a stolen cookie expires before it is used. See multi-factor authentication.

Register the obvious lookalike domains for your own brand, and enforce DMARC at p=reject.

Flag external mail clearly in the client, so a lookalike domain reading as internal stands out.

If a payment has already gone out

Order matters, and the first hour is most of the outcome.

Call your bank’s fraud team immediately and ask for a recall. Do this before anything else: before investigating, before telling anyone.
Contact the receiving bank directly as well if you can identify it.
Report to ReportCyber: a report number helps the banks act, and to Scamwatch.
Preserve the mailbox. Do not delete the fraudulent emails or the inbox rules; export mailbox audit logs before retention lapses.
Reset credentials and revoke sessions for the affected mailbox. A password reset alone does not end an attacker’s existing session.
Check for other victims. If a mailbox was compromised, assume the attacker also contacted your other suppliers and customers from it. Warn them.
Assess your privacy obligations. A compromised mailbox usually means personal information was accessible, which can make this a notifiable data breach quite apart from the money. See the Notifiable Data Breaches scheme, which the OAIC administers.
Tell your insurer. Social engineering losses are often excluded from standard cyber policies and covered under a separate crime policy. Check which you hold, ideally before you need to know.

The uncomfortable part

Most organisations that lose money to BEC had MFA, had a spam filter, and had run awareness training. What they did not have was a rule that made it impossible for one person, under time pressure, to change where money goes based only on an email.

Fix the process. The technology was never going to catch this one.

Common questions

What is business email compromise?

Fraud carried out through a compromised or convincingly spoofed mailbox, usually to redirect a legitimate payment to an account the attacker controls. There is typically no malware involved. The attacker simply reads real email and inserts themselves into a real conversation.

Can we get the money back after invoice fraud?

Sometimes, and speed is almost the only variable that matters. Recovery depends on the receiving bank freezing the funds before they are withdrawn or moved on, often within hours. Call your bank immediately, ask for a recall, and report to ReportCyber and to your bank’s fraud team in parallel.

Why did our spam filter not stop it?

Because in most cases nothing malicious was sent. The email came from a real, compromised mailbox, in a real thread, with no attachment and no link. There is nothing for a filter to detect, which is why BEC is a process problem rather than a filtering problem.