Invoice fraud and business email compromise: how companies lose money without any malware

Business email compromise (BEC) is one of the most costly types of cybercrime, and it often needs no malware at all. The attacker takes over or imitates the mailbox of a supplier, a director or an accountant and sends a convincing request: pay this invoice, change the bank details, make an urgent confidential transfer.

Typical scenarios

• Changed bank details: a “supplier” informs you that their bank account has changed.
• CEO fraud: the “director” writes on a Friday evening asking for an urgent, confidential payment.
• Hijacked conversation: the attacker joins a real email thread with a partner and replaces the invoice.

How to protect the company

1. Verify any change of bank details by phone, using a number from your records — never from the email.
2. Introduce two-person approval for payments above an agreed amount and for new recipients.
3. Protect mailboxes with MFA and block automatic forwarding to external addresses.
4. Configure SPF, DKIM and DMARC so others cannot easily send email in your name.
5. Mark external emails with a visible banner.
6. Train accounting and management teams with real examples.

If it already happened

Call your bank immediately and ask to stop or recall the transfer, report it to the police, and check the mailbox for unknown rules and logins. Speed is critical.

An urgent payment request plus new bank details is a reason to stop and call.

Need help with this? Contact CySec for a free consultation.

All articles