Business email compromise: the quiet scam hitting SMBs

Most cyber attacks make noise. Screens lock up, files stop opening, someone notices. Business email compromise is different: nothing breaks, nobody gets a warning, and the first sign is usually a supplier ringing to ask why they have not been paid. It is one of the most commonly reported cybercrimes against Australian businesses, and it works because it targets people and processes rather than computers. The good news is that it is also one of the most preventable.

What business email compromise actually is

Business email compromise (often shortened to BEC) is when a criminal uses email to trick someone in your business into sending money or sensitive information to the wrong place. There is usually no virus involved. The criminal simply writes a convincing email, at the right moment, to the right person.

It tends to come in a few familiar shapes:

• The changed bank details. A “supplier” emails to say they have moved banks and asks you to update their details before paying the next invoice. The invoice is real; the bank account is not.
• The urgent request from the boss. Someone in accounts gets an email that appears to come from the owner or a director: “I’m in meetings all day, can you quickly pay this for me?” The pressure and the seniority do the work.
• The hijacked conversation. A criminal gets into a real mailbox (yours or a supplier’s), reads the email history, waits for an invoice to be due, then slips into the thread with new payment instructions. Because it is the genuine conversation, it looks completely normal.
• The settlement or deposit switch. Common in property, legal and accounting work, where large one-off payments are expected and a last-minute change of account does not seem unusual.

The third one is the most dangerous, because there is no misspelt address to spot. The email really did come from the right mailbox.

Why small businesses are a favourite target

Criminals go where the effort is low and the payoff is good. Small and medium businesses often have a single person who can both change supplier details and approve payments, a busy inbox, and a culture of getting things done quickly without fuss. That is not a criticism; it is how most small teams run. It just happens to be exactly what this scam relies on.

Professional services firms are especially attractive because they handle client money and regularly email invoices, trust account details and settlement figures. We covered some of the seasonal versions of this in our post on tax-time scams targeting accounting firms.

It is also worth knowing that money sent by bank transfer is often very hard to get back once it has been moved on, which is why prevention matters far more than cure here.

How criminals get into a mailbox in the first place

For the hijacked-conversation version, the criminal needs access to a real mailbox. The usual routes are:

• A fake sign-in page. Someone clicks a link to “view a shared document”, lands on a page that looks exactly like the Microsoft 365 login, and types their password.
• Reused passwords. A password leaked from some unrelated website gets tried against the work account, and it works.
• Stolen sessions. More advanced phishing kits now capture not just the password but the signed-in session itself, which can let a criminal walk straight past a basic multi-factor authentication (MFA) prompt.

Once inside, they often quietly set up an inbox rule that hides or forwards certain emails, so the real owner never sees the replies. They can sit there for weeks, reading and waiting.

What actually stops it

There is no single product that makes BEC go away. What works is a few layers: some technical, some about how your team handles money. Each one catches what the others miss.

1. Make payment changes boring and verified

This is the most important step and it costs nothing.

• Never accept new bank details by email alone. Ring the supplier on a phone number you already have on file (not one in the email) and confirm the change.
• Use two people for payments above a set amount, or at least for any first payment to a new or changed account.
• Give staff permission to slow down. Make it clear that nobody, including the owner, will ever be annoyed at a phone call to double-check an urgent payment request. Urgency is the scammer’s main tool, so take it away.

2. Treat MFA as the floor, not the ceiling

MFA is essential and every account should have it. But because some phishing kits can now get around basic MFA, it should be your baseline, not your whole answer.

The stronger step is to control which devices can reach company data at all. If your business has Microsoft 365 Business Premium, you already pay for Conditional Access, which can require that a sign-in comes from a company-managed, up-to-date device before it gets anywhere near email or files. A criminal with a stolen password (or a stolen session) on their own laptop simply gets turned away. Pairing this with stronger sign-in methods such as passkeys or the Microsoft Authenticator app closes most of the common gaps. Many businesses already have these controls sitting unused; we explain what is included in the Business Premium security features you’re paying for but not using.

3. Switch on the email protections you already have

A few settings make a real difference:

• Block automatic forwarding to outside addresses, so a criminal cannot quietly copy every email to themselves.
• Alert on new inbox rules, especially ones that delete or hide messages.
• Tag external emails so a message pretending to be from your director but actually coming from outside the business stands out.
• Protect your own domain with properly configured email authentication (known as SPF, DKIM and DMARC). This makes it much harder for someone to send email that pretends to be from your business to your clients and suppliers.
• Use the advanced phishing and link protection in Microsoft Defender for Office 365, which is included in Business Premium.

4. Line it up with the Essential Eight

The Australian Signals Directorate’s Essential Eight is a sensible framework for small businesses to work towards. It is mostly focused on stopping malicious software and limiting damage, but several of its strategies directly reduce BEC risk: MFA, restricting administrative privileges, and keeping applications and operating systems patched all make it harder for a criminal to get in and stay in. Working towards Essential Eight alignment gives you a structured plan rather than a collection of one-off fixes.

5. Train people on the real thing

Generic “don’t click links” training only goes so far. The most useful training shows staff what BEC actually looks like in your type of business: the changed bank details request, the urgent director email, the invoice that arrives in a genuine thread. Short and regular beats long and annual.

If you think it has happened

Speed matters. If money has gone to the wrong account:

1. Call your bank immediately and ask them to try to recall or freeze the payment.
2. Report it through ReportCyber at cyber.gov.au.
3. Reset the password on any affected mailbox, sign it out of all sessions, and check for inbox rules or forwarding you did not set up.
4. Warn the supplier or client involved, because their mailbox may be the one that was compromised.
5. Get help reviewing the account, so you know how they got in and whether anything else was accessed. Depending on what was exposed, you may also have obligations under the Notifiable Data Breaches scheme.

The short version

Business email compromise succeeds because it looks like normal business. The fix is mostly about making normal business a little harder to fake: verify payment changes by phone, use the security controls in Microsoft 365 you are already paying for so only your managed devices reach your data, and help your team recognise the pattern.

If you would like a hand checking where your business stands, our IT security team can review your Microsoft 365 setup and payment processes, or you can learn more about how we manage and secure Microsoft 365 for small businesses.

Adam Dodds

Adam leads the Itopia team in Brisbane, helping professional-services firms get secure, productive and confident with their technology, in plain English.