Business email compromise: why it beats the spam filter

The email that empties a bank account rarely looks dangerous. No attachment, no link, no misspelled brand name. Just a short note from a vendor your accounts payable team has paid for years, saying the company changed banks and the next invoice should go to the new account. That is business email compromise (BEC), the attack most likely to cost a mid-size company real money this year.

The FBI's Internet Crime Complaint Center counted 21,442 BEC complaints in its 2024 Internet Crime Report, with reported losses of $2,770,151,146. Only investment fraud cost victims more. A September 2024 FBI public service announcement put exposed BEC losses above $55 billion worldwide from October 2013 through December 2023. Those are reported figures; the true number is higher.

Why the spam filter never sees it

A filter that depends on signatures, reputation, and known-bad indicators needs something to match. A BEC message gives it nothing. The text is plain, the request is routine, and in the worst cases it is sent from a real, compromised mailbox at the vendor, so every authentication check passes. The FBI describes these requests as well worded and specific to the targeted business. That specificity comes from reading a mailbox first.

Two patterns account for most of what we see:

1. Account takeover. An employee's Microsoft 365 credentials are phished, the attacker logs in, reads months of invoice threads, and waits for a payment to come due. Then they reply inside the real thread with new bank details.
2. Impersonation. The attacker never breaks in. They register a lookalike domain, or set a display name to match your CEO or a known supplier, and send a request that looks ordinary to a busy person on a phone.

Neither pattern trips a signature. Both are stopped by controls that have nothing to do with signatures.

Who is exposed and how to tell

Any company that pays invoices by ACH or wire is a target. The questions that matter are about your tenant and your process, not your industry. Check these today:

• In Microsoft 365, does anyone still sign in with a password plus an SMS code or a simple push approval? Both can be phished or fatigued through.
• Does your domain publish a DMARC record, and does it say p=none? That policy is monitoring only. It tells receiving systems to do nothing with mail that fails.
• Do you license Defender for Office 365? If not, user and domain impersonation protection is not available to you. Microsoft documents those features as exclusive to Defender, and the default anti-phishing policy leaves them unconfigured even when licensed.
• Can someone in accounts payable change a vendor's bank account because an email asked?
• When an employee gets a suspicious message, do they know what button to press, and does anyone read what they report?

If three or more answers are the wrong ones, assume a BEC attempt will eventually succeed. The only open question is the invoice amount.

What business email compromise costs

The direct loss is the payment itself, and recovery is uncertain. The FBI's advice is to contact your bank immediately to request a recall and to file a complaint at ic3.gov, because the IC3 may be able to help a bank freeze funds. That help is real; it is not a guarantee.

The indirect costs are the ones people forget. If the attacker was inside a mailbox, you have a data incident to investigate: what was read, what was forwarded, whether client data left. Cyber insurers ask specifically about MFA and email authentication, and a claim can be contested if the questionnaire answers do not hold up. And a vendor whose invoice was redirected still expects to be paid.

The five controls that stop it

Do these in order. Each closes a path the one before leaves open.

1. Phishing-resistant MFA for everyone, admins first

CISA "strongly urges all organizations to implement phishing-resistant MFA," meaning FIDO2 security keys, passkeys, or certificate-based authentication. Those methods bind the login to the real site, so a proxy phishing page cannot replay it. Start with global admins and anyone who approves payments. If you cannot get there for all users yet, CISA recommends number matching on push notifications as the interim step, and is clear that it is weaker than the phishing-resistant options.

2. SPF, DKIM, and DMARC at enforcement

DMARC, now published by the IETF as RFC 9989, lets your domain tell the world what to do with mail that claims to be from you and fails authentication. It only works if SPF and DKIM are in place first and the authenticated domain aligns with the From address. Microsoft's guidance is to roll out in stages: publish p=none with a reporting address, read the aggregate reports, fix the legitimate senders that fail, move to p=quarantine, then p=reject. Do low-volume subdomains first and the parent domain last. Set the onmicrosoft.com domain to p=reject as well if you do not send from it; Microsoft documents that step separately.

Enforcement protects your vendors and clients from mail that pretends to be you. It does nothing against a lookalike domain. That is what control three is for.

3. Impersonation detection in Defender for Office 365

In the Defender portal, edit the anti-phishing policy under Email & collaboration > Policies & rules > Threat policies > Anti-phishing. Add your executives and finance staff to user impersonation protection (the limit is 350 users per policy) and your key vendor domains to domain impersonation protection (50 custom domains per policy). Turn on intelligence for impersonation protection; mailbox intelligence itself is on by default, but the impersonation action is not. For each of the three, set the action to quarantine rather than the default of no action. Then check the impersonation insight weekly. It shows the previous seven days of detections, the fastest way to learn who is being targeted.

4. A payment-change verification rule with no exceptions

This is the control that works when every technical control has failed. No bank account change, new vendor, or wire instruction is accepted from email alone. Someone calls the vendor at a number already on file, never a number in the message, and confirms. The FBI's BEC guidance says the same thing: verify account changes through a secondary channel. Write the rule down, train the people who approve payments, and make any exception require a second approver. An attacker inside the thread will push for urgency and secrecy. Those two words are the signal to slow down.

5. A reporting loop that someone actually closes

Turn on user reporting at https://security.microsoft.com/securitysettings/userSubmission and use the built-in Report button in Outlook, which Microsoft supports in the new Outlook for Windows, Outlook on the web, current Microsoft 365 builds, Mac, iOS, and Android. Send reports to a mailbox your team reads, and to Microsoft. Then act on them: when one employee reports a fake invoice, search the tenant for the same sender and pull it from every other inbox. A report nobody reads trains people to stop reporting.

If a mailbox was already taken over, the attacker may also have a foothold on the endpoint. Pair the email controls with Managed EDR so a compromised laptop does not become the next entry point.

When to bring us in

If your DMARC record still says p=none, your finance team approves bank changes by email, or you own Defender for Office 365 and have never opened the anti-phishing policy, talk to us. Managed email security from Padlock covers the tenant configuration, the DMARC rollout, and the weekly review. The first step is a 30-minute intro call where we listen to your situation and tell you what we would do first. Request it at padlocktech.com/#contact.