The wire-fraud email that looks completely normal
Business email compromise doesn’t need malware or a genius hacker. It needs one convincing message on a busy afternoon. Here’s how it works and the five guardrails that stop it.
The call usually starts the same way: “We paid an invoice last week, and the vendor says they never got the money.” By then the funds have typically moved through several accounts and the recovery window is closing fast.
Business email compromise (BEC) is consistently one of the costliest forms of cybercrime reported to the FBI, and mid-sized companies are a favorite target. They move real money, they work with lots of vendors, and they rarely have anyone whose job is to question a routine-looking email.
How it actually happens
In a recent investigation for a Texas manufacturer, the attacker didn’t guess a password. They sent a well-crafted phishing link that routed the employee through a fake sign-in page sitting in the middle of the real one. The employee entered their password and approved the MFA prompt exactly as usual. The attacker captured the resulting session and, for practical purposes, was that employee.
From there, the playbook is patient: read the mailbox, learn who pays whom, set up a rule to hide replies, then send one small, perfectly timed request. “Our bank details have changed.” “Please use the attached updated invoice.”
MFA is essential, but a standard push or code prompt won’t stop a session-hijacking attack on its own. The payment process has to be secure, not just the login.
Five guardrails that stop it
1. Verify every payment change out of band. Any new or changed bank details get confirmed by phone, using a number you already had on file, never the one in the email. Make it policy, and make it safe for a junior employee to hold a payment for the check.
2. Require two people for wires above a threshold. One person initiates, a different person approves. Attackers rely on a single point of trust.
3. Move to phishing-resistant sign-in for key roles. Passkeys or hardware security keys for finance, executives, and admins, plus conditional-access rules that flag unfamiliar devices and locations.
4. Watch for mailbox rules and odd sign-ins. New forwarding or “move to folder” rules are a classic sign of compromise. Your IT provider can alert on these, as long as someone asks them to.
5. Rehearse the first hour. Who calls the bank? Who resets the account? Who calls the insurer? A 60-minute tabletop exercise turns panic into a checklist, and speed is what recovers money.
If it happens to you
Call your bank immediately and ask for a recall, file a report at the FBI’s Internet Crime Complaint Center (ic3.gov), notify your cyber insurer before you hire anyone (many policies require it), and preserve the email logs. Don’t just delete the phishing message and reset the password; you need to know what else the attacker saw.
None of this means your people are careless. It means they’re human, and these attacks are built to look completely normal. The fix is a process that doesn’t depend on anyone spotting the fake.