The Anatomy of a Business Email Compromise

The common entry point is a phished credential or a stolen session token. A staff member types their password into a convincing sign-in page, or approves an MFA prompt that an adversary-in-the-middle kit relays to the real identity provider, and the attacker walks away with a working session. Nothing crashes and no malware lands on a machine. The mailbox simply gains a second, silent reader.

The first hours inside the account are spent on persistence, and the standard tool is the inbox rule. One rule forwards copies of incoming mail to an external address, so the attacker keeps visibility even if the password later changes. Others are keyed on words like invoice, payment, remittance or bank, and move matching replies into folders nobody opens (RSS Feeds and Conversation History are favourites) after marking them read. The purpose is to let the attacker answer email as the owner without the owner ever seeing the replies. Rules like these survive a password reset, which is why victims who only changed the password are so often defrauded again weeks later.

Then comes the quiet period. The attacker reads. They learn which suppliers invoice you, for how much, on what cycle, who approves payments, and how those people write. A few keyword searches lay out the commercial rhythm of a business in an afternoon.

The strike is a reply inside a genuine thread. It quotes the real history, uses the right names and the right sign-off, and arrives at a plausible moment, typically just after a real invoice has been issued. This is thread hijacking, and it defeats the standard advice about checking the sender, because the sender is real and the message is authentic in every respect a reader can check.

Supplier impersonation runs the same play from the other side. If the compromise happened in your supplier's tenant, the fraudulent email genuinely comes from their mailbox and passes every technical check you can run. Where the attacker cannot get inside, they register a lookalike domain (a transposed letter, a .co in place of a .com.au) and copy the thread across so the conversation appears to continue seamlessly. Some victims correspond with the lookalike for weeks without noticing.

The finale is small and boring. An email advises that the supplier has changed banks, or a fresh invoice arrives that is identical to the real one except for the BSB and account number. There is often gentle pressure attached: a due date, an end of quarter, a signatory supposedly travelling. Accounts payable updates the vendor record and pays. The money typically moves through a chain of mule accounts within hours and becomes harder to recover with every hop.

Nothing about the transaction looks wrong from the inside. The approval workflow was followed and the request arrived on the right thread from the right address. That is why the defence cannot depend on someone spotting a fake. It has to assume the email channel is compromised and verify through a different one.

The strongest control is a verification callback, and it costs a phone call. Any request to change bank details, and any first payment to a new account, gets verified by phoning the counterparty on a number your organisation already holds, taken from the vendor master record or an earlier contract and never from the email or invoice requesting the change. Write it down as a procedure, allow no exceptions for urgency or seniority, and tell your suppliers you do it so they expect the call. The procedure works because the attacker does not control the phone number on file.

Email authentication does a narrower job than its reputation suggests. SPF, DKIM and a DMARC policy at quarantine or reject stop mail that claims to be exactly your domain, which protects your counterparties from fraud carried out in your name and, where their domains enforce the same, protects you in return. DMARC does nothing about lookalike domains and nothing about a genuinely compromised supplier mailbox, so treat it as necessary hygiene that removes one technique from the kit.

The third layer is visibility inside your own tenant. In Microsoft 365 the signals that expose a compromise in progress are ordinary audit events, and most tenants already record them without anyone watching. A small set of alerts covers the pattern:

Treat a confirmed compromise as an intrusion into your identity platform rather than a bad email, and work in an order that closes doors before it announces anything. The first day looks like this:

The checklist above contains the urgent work. The hard work is scoping: establishing when the intrusion began, which threads were touched, which other mailboxes carry the same rules, and whether personal information in the mailbox was accessed. That means reconstructing weeks of activity from the audit trail, and it is the point where most organisations bring in outside help. We do this work in incident engagements, and the audit trail is almost always richer than the victim expects, provided nobody destroyed it in the first panicked hour.

The scoping answer matters legally as well as operationally. A business mailbox almost always contains personal information, so the Notifiable Data Breaches scheme under the Privacy Act 1988 may apply, with up to thirty days to assess whether an eligible data breach has occurred and an obligation to notify the OAIC and affected individuals as soon as practicable once you believe it has. This note is general information; take advice on your organisation's specific obligations.

Business email compromise succeeds because each step looks unremarkable on its own: a login, a rule, a reply, an updated bank record. The defence works the same way in reverse. Phishing-resistant MFA narrows the entry point, mailbox alerting exposes the rule the attacker needs on day one, DMARC removes exact-domain spoofing, and the callback procedure stops the payment even after every technical control has failed. Rehearse the callback with your accounts team the way you would rehearse an incident, because the person most likely to save you is whoever picks up the phone before paying.