Business email compromise: anatomy of a wire-fraud attempt

A controller at a company we know paid a real invoice — right vendor, right amount, right due date — into the wrong bank account, and nobody knew for days. No malware was involved. Nothing was “hacked” that morning. The actual crime had happened five weeks earlier, quietly, and everything since had been theater. Business email compromise is the most boring-looking fraud in the world, which is exactly why it clears more money than the flashy stuff. Here's the play, act by act.

Act one: the quiet break-in

It starts with a password — phished through a fake login page, or bought from an old breach dump because someone reused it. The attacker signs into the mailbox and then does something unnerving: nothing. No ransom note, no locked files, no drama. Maybe a discreet forwarding rule, so copies of interesting mail flow out silently. Without multi-factor authentication this step is trivial, and with nobody watching the sign-in logs, it's invisible.

Act two: the homework

Then they read. For weeks. They learn your invoice rhythm, who approves payments and up to what amount, which vendor is owed a big number soon, how the boss actually writes (“thx — R”), who travels when. Sometimes they add mailbox rules that quietly shuffle certain replies into folders you never open, so a suspicious vendor response never reaches you. Patience is the entire skill. By the end, they know your accounts-payable process better than your newest employee does.

Act three: the swap

At the perfect moment — a real invoice coming due, the owner traveling, a Friday before a holiday week, and the holiday weeks are now upon us — the email arrives: “Please note we've updated our banking details for the attached invoice.” It comes from the vendor's real, compromised address, or from a lookalike domain one letter off. Same thread. Same signature block. Same tone, because the tone was studied. The controller updates the record and pays, feeling efficient.

Act four is the vanish. The money lands in a mule account and hops twice before anyone's coffee is cold. Days later, the real vendor calls about their unpaid invoice, and the whole story surfaces at once, in front of everyone. Recovery is a race measured in hours: call your bank immediately and ask for a recall, file a report with the FBI's IC3, and get your attorney and your insurer on the phone the same day — policies carry notification deadlines that do not care how busy your week was.

Where the play breaks

Every act has a countermeasure. MFA breaks act one: the stolen password alone stops being enough. Monitoring breaks act two: a sign-in from an unfamiliar country and a brand-new forwarding rule are fire alarms, if anyone is listening — our 24/7 SOC listens for precisely those. Act three dies to a rule that costs nothing: any change to payment details triggers a phone call to the number already on file, not any number in the email, before a dollar moves. Hold those three lines and act four never gets its scene.

Cyber Alamo's managed plan hardens the mailbox on Google Workspace, Microsoft 365, or Proton, and watches logins and inbox rules around the clock. If your business pays anyone by wire or ACH, book the free assessment this month. The whole design of this play is that act one already happened, weeks ago, and everything still looks completely fine.