The Situation

Accounts payable gets an email from a long-time supplier, in a real thread, from the supplier's real address. It says their bank changed and asks that this month's payment go to the new account. The invoice amount is right. The tone is right. The payment goes out. Three weeks later, the supplier asks why they haven't been paid.

That's business email compromise (BEC). The FBI's Internet Crime Complaint Center has listed BEC among the costliest types of cybercrime reported to it for years, and it rarely involves malware.

BEC follows a predictable sequence. Each step is a chance to stop it.

Step 1: The Credential Is Stolen

What happens: Someone at your company, or at your supplier, enters their Microsoft 365 or Google password on a fake login page. Modern phishing kits can also capture the MFA session at the same time, a technique called adversary-in-the-middle (AiTM).

Break the chain:

  • Move to phishing-resistant MFA (passkeys or FIDO2 security keys) for finance staff, executives and admins first. Text codes and push approvals can be relayed by AiTM kits.
  • Use conditional access rules that block sign-ins from unmanaged devices or unusual locations.

Step 2: The Attacker Logs In Quietly

What happens: The attacker signs in, often from a cloud hosting provider or VPN, and reads email. They aren't in a hurry. They're learning who pays whom, how invoices look and when payments go out.

Break the chain:

  • Alert on impossible-travel and risky sign-ins. Microsoft Entra ID Protection and similar tools flag these.
  • Make sure someone actually reviews those alerts, whether that's your team or an MDR provider that covers Microsoft 365.

Step 3: The Attacker Hides

What happens: The attacker creates inbox rules that move replies from the supplier or the bank into a hidden folder, or delete them. That way the real person never sees the conversation.

Break the chain:

  • Alert on new inbox rules that forward, delete or move messages, especially rules that mention words like "invoice," "payment" or "bank."
  • Block automatic forwarding to external addresses unless there's an approved business need.

This is one of the most reliable early warning signs of BEC, and it's often overlooked.

Step 4: The Fraudulent Request

What happens: The attacker replies inside a real thread, or registers a look-alike domain (for example, swapping a lowercase "l" for a capital "I"), and requests a change in payment details or an urgent transfer.

Break the chain:

  • Use email security that looks at behavior, such as a first-time bank change request, an unusual tone or a slightly different domain, not just links and attachments. API-based tools for Microsoft 365 and Google Workspace focus on this.
  • Make sure SPF, DKIM and DMARC are set up on your own domains, with DMARC at an enforcement policy. This makes your domain much harder to impersonate.
  • Tag external email clearly in the subject or banner.

Step 5: The Payment Goes Out

What happens: Finance follows the instructions. This is the last chance, and it's the most important one, because it doesn't depend on any technology working.

Break the chain with process:

  • Call-back verification: any change to payment details is confirmed by phone using a number already on file, never one from the email.
  • Two-person approval for new payees and for transfers over a set amount.
  • A cooling-off period for newly changed bank details before the first payment.

If It Happens: The First Hour

Speed matters. Banks can sometimes recall a wire if they're contacted quickly.

  1. Call your bank's fraud line and request a recall.
  2. File a report with the FBI's IC3 (ic3.gov) in the U.S.
  3. Reset the compromised account's password, revoke its active sessions and remove any inbox rules.
  4. Review what else the attacker could have seen or sent from that mailbox.

What to Do Next

Run three quick checks this week: whether external auto-forwarding is blocked, whether you alert on new inbox rules, and whether your finance team has a written call-back rule for payment changes.

Buying or renewing soon? Stackcurve advisors help IT leaders compare vendors, benchmark pricing and negotiate contracts at no cost to you. Talk to an advisor → or get your free Cyber-Ready Score →

← Back to Blog

Stackcurve is independent. No vendor pays for placement or editorial influence on this blog.