Business Email Compromise is a very particular attack, known in Romania as invoice fraud. In this large-scale attack, a malicious actor takes over or fully imitates written business correspondence. At exactly the right moment for payment, the criminal quickly and precisely swaps the bank account for their own. The most frightening part is that no complex virus is ever planted in the network. You will not find any widespread infection flashing alarms on your office monitors. Nothing at all appears that would visually alert an ordinary antivirus program. All you actually have is a bank transfer made in the best possible faith. Through a terrible mistake, it ends up in a foreign account, from where the money quickly disappears far from your country. The financial loss is often colossal compared with how simple the attack itself is. Below we walk through a typical, fully anonymised case drawn from our incident response work.
How does a BEC attack work, step by step?
This dangerous type of fraud does not need any clever malware at all. It simply exploits your normal workflow, relying on everyday trust. The attacker manages to access your company's official email account undisturbed. It all starts with a simple reused password that has been badly neglected inside the organisation. The thief logs in, behaving completely differently from aggressive, noisy attackers. In the second phase of the attack, the criminal goes completely quiet, apparently doing nothing harmful for weeks. They simply start reading who regularly approves payments and which suppliers are paid. To keep their activity completely hidden, they create a few special rules in the targeted mailbox. These rules redirect all important correspondence full of commercial data into a folder the manager never sees.
When does the critical moment of intervention happen?
Only in the third phase does the uninvited guest at the other end make their fatal move. When the genuine invoice arrives from abroad, the hacker springs into action at once. They reply very politely, faithfully impersonating the supplier and brazenly using the supplier's own registered address. The message always looks so natural and plausible that it convinces anyone with normal experience. The text states briefly that the amount is correct, but that they have recently and urgently changed banks. A new attached document showing a different IBAN from the one you know is slipped into this short e-mail. The tone of the conversation fully matches the foreign supplier or the well-known local distributor. The attacker has this huge tactical advantage thanks to the hundreds of messages they have already read through very carefully beforehand.
| Stage of the email theft | What the accountant saw and what actually happened behind the scenes |
|---|---|
| The bank-change notice sent electronically | The employee sees exactly the partner's sender address, although the substituted message is simply a fake routed internally. |
| The payment order is executed with no written confirmation | The money leaves quickly through another anonymous channel. Fake rules hide the partner's questions from the employee's mailbox. |
| The late payment is discovered | The real supplier calls, angry, a few weeks later, but the criminal has already withdrawn and spent the entire amount. |
Why is this major corporate disaster so hard for companies to detect?
The fourth phase mainly involves the payment being made with ease, followed by complete silence in the office. From the point of view of a busy person in accounting, everything looks perfectly fine that day. The money flies to the hacker's account and the transactions are fully emptied within just a few hours. Any pertinent questions that arrive later are always systematically buried in the folders of the malicious redirect rules set up weeks earlier. Most desperate alerts unfortunately come from the dissatisfied supplier who lost the money. When the external incident response team arrives on site, the technical traces tell a completely different story. The victim company is convinced that the breach happened on the partner's side. Our logs, however, always clearly show the same unauthorised logins from Asian countries, made directly into the company's own department. The victim company itself actually allowed the earlier technical intrusion that drained its savings.
What can you implement in your organisation for financial peace of mind?
National government reports by specialist experts now rank this scam among the top business risks in the private sector. They firmly call for intensive training, extra layers of attention and multiple safeguards written into job descriptions. An internal security procedure is far ahead of any computer tool when it comes to detecting fraud. Set the following rule straight away: any change to commercial bank accounts is confirmed strictly and only by phone. This is the well-known "second-channel verification" strategy, presented in the press as the golden rule. This task falls solely to the employee at the moment a large payment is triggered after receiving the document through the online application. Never give in to absurd pressure such as "so that it arrives today before noon". Always make sure official procedures exist and are followed rigorously, no matter who presses that final button. Talk to our representatives with confidence through the contact section of our website. By requesting a visit, an IT audit for companies greatly reduces the risk of your essential systems collapsing. We always come prepared with excellent cybersecurity solutions, ready to protect the profit of every small business.