Threat Spotlight: Business Email Compromise — the Quiet Crime Costing Billions

The most profitable cybercrime on earth involves no malware at all. Business email compromise (BEC) is patient, quiet fraud: an attacker gains access to — or convincingly imitates — a business email account, studies how the company moves money, then redirects a real payment. Global law-enforcement reporting (including the FBI’s long-running IC3 data) has consistently ranked BEC losses above ransomware, and the ACSC names email compromise among the top self-reported incidents for Australian business.

Anatomy of the attack

• Entry: a phished password (often via a fake Microsoft 365 login page) or a lookalike domain one letter off the real one.
• Patience: weeks of silent reading. Attackers set inbox rules that hide replies and learn the rhythm of invoices, suppliers and approvals.
• The strike: a genuine invoice thread continued with new bank details, or a "confidential and urgent" transfer request in the boss’s voice.
• The exit: money mule accounts, rapid onward transfers, and — after about 24 hours — very little chance of recovery.

Why SMBs are the sweet spot

Small businesses combine real money movement with informal processes: one person can often change payee details and pay. There’s no second approver, no verification ritual — precisely the gap this fraud walks through. Construction, real estate and professional services are hit hardest because large invoices between parties who rarely meet are normal.

What actually stops it

• MFA on every mailbox — most compromised accounts had none.
• Alerts on new inbox rules and unusual sign-ins — the early fingerprints of a takeover.
• DMARC, SPF and DKIM on your domain so criminals can’t send as you.
• The unbreakable ritual: any change of bank details is verified by phone on a number you already had. No exceptions, including for the CEO.

BEC is beatable — not with one product, but with a hardened mailbox and one stubborn habit. Teach the callback ritual until it’s boring. Boring is the goal.