Business email compromise: stopping payment fraud

The most expensive email many organizations ever receive looks completely ordinary. A supplier you have paid for years writes to say their bank details have changed. An employee asks payroll to update their direct deposit. The owner, travelling and hard to reach, asks for an urgent transfer to close a deal. Nothing is attached, no link is clicked, and the message passes every spam filter, because there is nothing malicious in it except the request.

This is business email compromise, and the Canadian Anti-Fraud Centre lists these variants by name: executive spoofs, payroll spoofs and supplier or contractor swindles that announce new payment details.[1] This guide is for owners, finance leads and IT managers at Canadian organizations running Microsoft 365. It covers the controls that make this fraud hard to pull off, split between what Microsoft 365 can do and what only your payment process can do.

How the fraud actually works

These frauds work because they ride on relationships that already exist. The message appears to come from someone the recipient knows, and often the sender address looks exactly right.[1] There are two common ways an attacker gets there.

• Impersonation from outside. The attacker registers a lookalike domain or forges the display name of a colleague or supplier. Microsoft notes that an impersonating domain can otherwise look legitimate: it is registered and may even have its email authentication records in place. The intent is what makes it fraudulent.[4]
• A real mailbox taken over. The attacker signs in to a genuine account, often after a phishing message, and quietly creates a rule that sends copies of incoming mail to an account they control. They read the traffic to learn how people write, who gets paid and when, then strike when the real owner is hard to reach by email or phone.[2]

The second route is the dangerous one. The fraudulent request arrives in the middle of a real conversation, from a real address, with the right invoice numbers. No filter can judge whether a change of bank details is genuine. That is why the defence has two halves.

Close the doors attackers use to get in

Start with account takeover, because it defeats every other check. The Canadian Centre for Cyber Security advises turning on multi-factor authentication for every employee and administrator account, and using phishing-resistant methods where possible, since they also resist push-notification fatigue attacks.[3] Prioritize finance, payroll, executive and administrator mailboxes, then extend it to everyone. A shared or forgotten mailbox without MFA is exactly where an attacker will start.

Then switch off the tool attackers rely on once they are inside. Microsoft 365 lets users forward mail outside the organization through Inbox rules, and lets admins set mailbox forwarding. Both are controlled by the outbound spam filter policy.[5] Three points matter:

• Set the forwarding control explicitly. The default value, Automatic, does not behave the same way in every tenant. Microsoft recommends choosing On or Off rather than leaving it on Automatic.[5]
• Turning it off is effective. With external forwarding disabled, Inbox rules and mailbox forwarding that redirect mail to outside addresses stop working and the message bounces. Forwarding between internal users is not affected.[5]
• Allow exceptions narrowly. If a genuine business need exists, keep forwarding off broadly and allow it only to specific external domains through remote domain settings.[5] Check the Auto forwarded messages report first to see who forwards today, so the change does not break a process nobody documented.[5]

Make impersonation visible to the people reading mail

Every Microsoft 365 cloud mailbox includes basic anti-phishing features: spoof intelligence, the first contact safety tip and unauthenticated sender indicators.[4] The first contact safety tip warns a recipient when they rarely or never receive mail from a sender, and Microsoft recommends turning it on as an extra layer against impersonation.[4] A supplier's lookalike domain will usually trigger it.

Add external sender identification as well. Once enabled, supported versions of Outlook show an External marker on messages from outside the organization, so a message claiming to be from the owner but sent from outside stands out. Microsoft notes it can take 24 to 48 hours to appear, and that any older mail flow rules adding "External" to subject lines should be disabled first to avoid duplicate labels.[6]

If your licences include Microsoft Defender for Office 365, impersonation protection goes further. You can name specific people to protect, such as executives and the finance team, and the domains you own or trade with, and decide what happens to messages that impersonate them.[4] This is not switched on fully by default: the default Defender policy turns on spoof protection and mailbox intelligence, but user and domain impersonation protection must be configured.[4] Each policy can protect up to 350 users and 50 custom domains, which is enough for most small and mid-sized organizations to cover every person who can approve or change a payment.[4]

Email authentication on your own domain belongs in this layer too, because it makes your domain harder to spoof against your customers. Our guide to Microsoft 365 email authentication covers SPF, DKIM and DMARC in detail.

Put the real control in the payment process

The technical settings lower the odds; the payment process decides the outcome. A well-written request from a compromised supplier mailbox can pass every check in Microsoft 365. The Canadian Anti-Fraud Centre's advice for businesses is procedural for that reason: detailed payment procedures that include verbal confirmation for any urgent request or change in payment details, and a verification step for unusual requests.[2]

Turn that into rules your finance team can follow without debate:

1. Verify every change of banking details by phone, using a number already on file or from the original contract, never one supplied in the email asking for the change.
2. Apply the same rule to payroll. A request to change an employee's direct deposit is a known variant of this fraud.[1] Confirm it in person or through a channel the employee already uses.
3. Treat urgency and secrecy as warning signs. "Keep this confidential" and "it must go today" are the pressure the fraud depends on. A rule that urgent payments get more checking, not less, removes that pressure from the person approving.
4. Require two people for new payees and large transfers, so a single persuaded employee cannot complete the fraud alone.
5. Train for it, including new starters. The Anti-Fraud Centre recommends fraud awareness for all employees and as part of onboarding, and the Cyber Centre recommends regular, updated training for all personnel.[2][3] Show staff real examples of these requests, not only generic phishing.

Know what to do when it gets through

Decide the response before you need it. Microsoft lists the usual signs of a compromised mailbox: Inbox rules that forward mail to unknown addresses or move messages into rarely viewed folders such as Notes, Junk Email or RSS Subscriptions, recently added external forwarding, and unexplained password changes or lockouts.[7] Its recovery steps go beyond a password reset: revoke active sessions, review the account's MFA methods and remove any the attacker added, review app consents and administrator roles, and remove suspicious forwarding.[7] App passwords are not revoked by a password reset, so deal with those too.[7] Never send the new password to the user by email, because the attacker may still be reading it.[7]

On the finance side, call your bank as soon as a fraudulent payment is suspected. The Anti-Fraud Centre asks businesses to report incidents to their local police and to the Centre itself, and to report even attempts that failed, because reporting helps prevent further harm.[2] Write those contacts into the procedure now, so nobody has to look them up under pressure. Notice obligations under Canadian privacy legislation may also apply if personal information was exposed, so include that question in the plan.

Where this fits

Business email compromise sits between IT and finance, which is why it often falls between them. Our Microsoft 365 service covers forwarding controls, anti-phishing and impersonation policies, external sender identification and MFA. A cybersecurity assessment can show where accounts, mailboxes and payment approvals stand today, and our security policy and governance work turns the payment verification rules above into a written procedure your team can follow.

If you want to make payment fraud by email much harder in your organization, contact HAI Consulting for a free initial consultation. We will review how your Microsoft 365 tenant handles forwarding and impersonation, walk through how a change of bank details is approved today, and tell you plainly which gaps to close first.