Business email compromise uses a trusted mailbox to push invoice or payment fraud, often by abusing a real vendor thread or a convincing executive request.
The goal is usually a changed bank account or an urgent transfer, and the trust people already place in that mailbox is the weapon.
How it works
Sometimes the attacker truly controls a partner mailbox and continues an existing invoice conversation, and sometimes the message only looks internal, with a close display name and a reply address that does not match.
Both patterns ask finance staff to update payment details or to send funds before the usual checks.
Losses are large because the payment is authorized by a real employee who believes the request is legitimate.
Technical filters help, yet the lasting control is a rule that payment changes are confirmed on a known phone number, never inside the same thread.
Concrete examples
- A supplier thread that has been genuine for months suddenly asks accounts payable to switch the destination bank account.
- A message that appears to come from the chief financial officer demands a same day transfer and asks the clerk not to call.
- A compromised payroll mailbox sends staff a fake portal link, and the later payment file is altered before it reaches the bank.
Protective measures
- Confirm every bank account change with a phone call to a number you already stored, not to a number printed in the requesting message.
- Require two people to approve new payees and payments above a set amount, and forbid that approval to happen only by mail.
- Mark external mail clearly, and teach staff that a familiar thread can still be continued by someone who stole the mailbox.
- Protect mailboxes that send or receive payment instructions with strong sign in checks and alerts on new forwarding rules.
Related articles
The article What is chief executive officer fraud? focuses on impersonating a senior leader, a pattern that often overlaps this payment fraud.
The article What is cloud email hosting? explains hosted mail, where a stolen mailbox can become the trusted sender.
The article What is corporate account takeover? covers seizure of a business login that can then authorize real payments.