When people talk about cybersecurity, most think of viruses and hackers breaking into systems. The fraud that costs businesses the most money is much simpler: someone convinces an employee to send a payment where it should not go.
No sophisticated technology is needed. It takes a believable email, a little urgency and a payment process with no verification.
How it works
The pattern repeats with few variations.
- The vendor who "changed banks." An email arrives, apparently from a known vendor, saying their bank account has changed. The next invoice is paid to the new account, which belongs to the scammer.
- The boss in a hurry. A message that appears to come from the owner or a manager asks for an urgent transfer or the purchase of gift cards, and asks for discretion.
- The invoice nobody expected. A well-designed invoice for a service the company does use, with payment instructions different from the usual ones.
- The message from the bank or an agency. An email or text that appears to come from your bank, a payment service or a government agency, with a link to "verify" your account.
In the most damaging cases, the attacker first gets into someone's mailbox, reads real conversations for days and then steps in at exactly the right moment, with the right tone and details.
Why it works
Because the message arrives at a believable moment, uses real names and asks for something the person does every day. And because it almost always includes urgency: today, before three, keep it confidential.
Urgency is the most reliable sign that something is wrong.
The defense that protects most is not technological
It is a process rule: no bank account change and no out-of-the-ordinary payment is executed without verification through a second channel.
- If a vendor emails to say their account changed, you call them at the number already in your records, not the one in the email.
- Payments above a certain amount require approval from two people.
- Nobody, not even the owner, is exempt from the process. The rule has to be stronger than the hierarchy, because the fraud relies precisely on authority.
This rule costs nothing and stops the great majority of attempts.
What technology does contribute
- Multi-factor authentication on everyone's email, so a stolen password is not enough to get in.
- Email filters that detect impersonation and flag messages coming from outside the company.
- Alerts when someone creates an automatic forwarding rule in a mailbox, which is one of the first things an attacker does after getting in.
- Short, regular training, with examples similar to what your people actually receive.
If it already happened
Time matters. Call your bank immediately to try to stop or reverse the transfer, change the passwords of the accounts involved, and notify your IT provider to check whether someone had access to the mailbox. Keep the messages; do not delete them.
And talk about the incident with your team without looking for someone to blame. The person who fell for it is the one who can best teach everyone else what the deception looked like.
← Back to the blog