Business email compromise does not look like hacking. It looks like a normal Tuesday: an email from a supplier you know, referencing a real invoice, politely noting that they have changed banks and asking you to update the payment details. The invoice is paid. The supplier never receives it. By the time anyone notices, the money is gone.
How they know so much
Usually because a mailbox was compromised — yours, or the supplier's — weeks earlier, and someone has been quietly reading. They know the invoice numbers, the names, the tone. Sometimes they set a rule so that replies are hidden. It is patient, and it is why "we are too small to be a target" is exactly wrong: small businesses pay invoices too.
The habit that stops it
Any change to payment details is confirmed by phone, on a number you already have, before anything is paid. Not the number in the email. Not a reply to the email. A call. It takes two minutes, and criminals cannot intercept it. Make it a written rule, put it beside the person who pays the bills, and let suppliers know you do it — good ones will thank you.
The technical side
- Multi-factor authentication on every mailbox, so a stolen password does not open it.
- Alerts for suspicious inbox rules and sign-ins from unusual places — exactly the signals our monitoring watches for on managed Microsoft 365 tenants.
- Proper sending setup (SPF, DKIM, DMARC) so nobody can send mail that looks like it came from you to your customers.
When we take on a Microsoft 365 environment, these protections go in as standard. The phone-call habit, though, is yours — and it is the one that has saved the most money for the least effort of anything on this page.
