Business Email Compromise — How Invoice Fraud Actually Happens

The most expensive attack a small business is likely to suffer involves no malware, no encrypted files, and no ransom note. It's an email that asks accounting to update a vendor's bank details, and accounting does it, because the email came from someone they know and it was about an invoice they were already expecting.

Business email compromise — BEC — is fraud that runs on legitimate access and ordinary business process. Your antivirus has nothing to detect. Your backups don't help; nothing was destroyed. The money simply leaves.

The FBI's Internet Crime Complaint Center has ranked BEC among the costliest categories of reported cybercrime for years running, and it disproportionately hits businesses in the 10-to-200 employee range — big enough to move real money, small enough that one person often approves payments alone.

Here's how it actually unfolds, and what breaks the chain.

Stage 1: Access, Usually Through a Convincing Login Page

Most BEC starts with credential phishing, not a virus.

An employee receives a message that appears to come from Microsoft, a shared document notification, a voicemail alert, or a DocuSign request. The link leads to a login page that is a pixel-accurate copy of the real one. They type their password.

Increasingly, that fake page is an attacker-in-the-middle proxy: it forwards the credentials to the real Microsoft login in real time, relays the MFA prompt to the victim, and captures the resulting session token. The employee gets logged in successfully. Nothing looks wrong. The attacker now has a valid session that survives a password change.

This is why "we have MFA" is a necessary answer but not a complete one.

Stage 2: Quiet Reconnaissance

The attacker does not immediately do anything. This is the part people find hardest to believe.

For days or weeks, they read. They learn who approves payments, which vendors invoice monthly, what the CFO's writing style looks like, when the owner travels, and which projects have large outstanding balances. They search the mailbox for terms like invoice, wire, ACH, remittance, and bank.

Then they set up persistence:

• An inbox rule that moves messages containing "invoice" or a specific vendor's domain to an obscure folder, or marks them read and deletes them
• A forwarding rule sending copies to an external address
• Sometimes a malicious OAuth application consent, which keeps access alive even after the password is reset

At this point the attacker is reading your mail and the account owner sees a normal inbox.

Stage 3: The Ask

Then comes one of a handful of well-worn plays:

Vendor invoice fraud. The most effective by far. The attacker replies inside a real, ongoing email thread with a real vendor about a real invoice, attaching an updated invoice with new banking details. "We've changed banks — please update your records." The thread history is genuine, which is exactly why it works.

Executive impersonation. A message from the owner to the controller: urgent, confidential, in a meeting, needs a wire out today. Often sent from a lookalike domain rather than the real compromised account.

Payroll diversion. An email to HR from an "employee" asking to update direct deposit details before the next run. Small dollar amounts, easy to miss, often repeated across several staff.

Lookalike domains. Not a compromised mailbox at all — a registered domain that differs by one character (netkraft vs netkarft, rn in place of m). Nobody reads addresses that carefully at 4:45 on a Friday.

Aging report harvesting. The attacker requests your accounts receivable aging report, then contacts your customers as you, redirecting their payments. Now your clients lose money and you find out from an angry phone call.

Why Email Filters Don't Catch It

Nothing in these messages is technically malicious. There's no attachment with a payload, no link to a known-bad domain, often no link at all. It's plain text about an invoice, sent from an authenticated account or a domain registered last month with valid SPF records.

Spam filtering is pattern-matching on badness. BEC isn't bad-looking. It's a business email that asks for a normal business action.

That's why the effective controls are split between identity hardening and process — and the process half matters more.

The Technical Controls That Matter

Work these in order:

1. Phishing-resistant MFA where it counts. Push notifications and SMS codes can be relayed. Passkeys, FIDO2 security keys, or certificate-based authentication cannot be phished the same way. Start with finance, executives, and IT admins.
2. Conditional access. Restrict sign-ins to expected countries and require compliant or managed devices for access to mail. A stolen session token from an unmanaged device in another country should fail.
3. Block legacy authentication protocols. Older mail protocols bypass modern MFA entirely and remain a common way in.
4. Alert on mailbox rule creation and external forwarding. This is the single highest-value detection in a small business, and it's usually a few clicks to enable. Attackers create rules within hours of access; almost no legitimate user creates a rule that deletes invoice emails.
5. Publish and enforce SPF, DKIM, and DMARC on your domain, and move DMARC to an enforcement policy rather than leaving it at monitoring. This stops others from spoofing your domain to your customers.
6. External sender warning banners. Crude, mildly annoying, and genuinely effective against lookalike domains.
7. Audit OAuth app consents and restrict which applications users can grant access to.
8. Retain sign-in and audit logs long enough to investigate. Many small businesses discover the answer is "30 days" only when they need 90.

Most of this is configuration in a platform you already pay for, which is a large part of what our cybersecurity assessment work turns up. For the wider foundation, see our complete guide to cybersecurity for small businesses.

The Process Controls That Matter More

Technical controls reduce the odds of compromise. Process controls make compromise not pay.

Never change payment details based on an email. Ever. Full stop. A bank detail change is verified by calling the vendor back on a phone number you already had on file — not one from the email, not one from the new invoice, not one from a signature block.

Require dual approval for any wire transfer, any ACH above a threshold you set, and any change to vendor or payroll banking information. Two people, two separate confirmations.

Put a callback rule in writing and make it a policy so the accounts payable clerk never has to weigh whether to annoy an executive. Policy removes the social pressure, which is the actual attack surface.

Slow down urgent requests. Urgency plus confidentiality plus a payment instruction is the signature of the attack. Train your team to treat that combination as a reason to verify, not a reason to hurry.

Verify new vendors before the first payment, not after.

Confirm large incoming-payment instructions with customers too, so nobody redirects your receivables.

None of this needs software. It needs a written procedure and a leadership team that backs up the person who follows it.

If It Already Happened: The First 24 Hours

Speed matters more here than in almost any other incident, because funds can sometimes be frozen before they're withdrawn.

1. Call your bank immediately and request a wire recall or ACH reversal. Ask specifically for their fraud department.
2. File a complaint at ic3.gov with full transaction details. The FBI's Recovery Asset Team can work with receiving banks to freeze funds, and the odds are substantially better within the first 72 hours.
3. Report to your local FBI field office and your local police department for the paper trail your insurer will want.
4. Preserve evidence before cleaning up. Export the mailbox audit log, sign-in logs, and the offending rules before you delete anything.
5. Reset the password and revoke all active sessions — a password reset alone does not kill a stolen session token.
6. Remove malicious inbox rules, forwarding addresses, and OAuth grants.
7. Check every other account that shared the password, and check whether other mailboxes were touched.
8. Notify your cyber insurer promptly; most policies have strict notification windows.
9. Assess notification obligations. If personal information was accessible in that mailbox, Colorado's breach notification law gives you a 30-day clock from determining a breach occurred.
10. Tell your vendors and customers if their threads were exposed. They're the next targets.

CISA maintains practical guidance on avoiding business email compromise worth circulating internally.

Frequently Asked Questions

Doesn't MFA prevent this? It prevents most password-only attacks, which makes it essential. It does not stop session-token theft from a real-time phishing proxy, which is why phishing-resistant methods and conditional access matter for the accounts that move money.

Will cyber insurance cover a fraudulent wire? Sometimes, and often under a separate "social engineering fraud" endorsement rather than the base cyber policy — frequently with a lower sublimit and a requirement that you followed a verification procedure. Read that endorsement before you need it.

How would we even know we'd been compromised? Common signals: a customer says they never received your reply, colleagues get replies to messages you didn't send, invoice emails are missing from a thread you know exists, or unfamiliar sign-in locations appear in audit logs. Rule-creation alerting turns this from a guess into a notification.

Is this related to ransomware? Different objective, overlapping entry point. Both often start with stolen credentials. Our guide to protecting your business from ransomware covers the destructive branch of the same tree.

Lock Down the Money Path

Most small businesses have decent antivirus and no written rule about verifying a bank-detail change. The second gap is the expensive one.

netkraft helps Denver-area businesses harden the identity side — MFA, conditional access, rule alerting, DMARC enforcement — and write the payment verification procedures that make a compromised mailbox a nuisance instead of a loss.

Contact netkraft for an email security and process review, or learn more about our cybersecurity and managed IT support services.