When the correspondence is the weapon
Business email compromise explained by Ilia Nikolaevich Zavialov: when the letter is genuine and the account is not
The most expensive fraud in the annual figures is also the least dramatic to look at. No malware, no broken system, no alarm. Somebody reads a mailbox for a few weeks, learns how a company writes, waits for a real payment to come due, and sends one message changing where the money goes. The FBI booked 3.05 billion dollars of losses under business email compromise in its 2025 report, second only to investment fraud, and the reason it works is that everything the recipient can check turns out to be correct.
English version for the United States.
What is actually compromised
The name is misleading because it suggests a technical break-in. In most cases the technical part ended weeks earlier and was small: a password reused from an old breach, a session token taken by a stealer, an approval nobody thought about twice.
What happens next is patient reading. The intruder sits inside the mailbox and learns the shape of the business: who signs off on what, what the invoices look like, which supplier is due, how the finance manager phrases a request, when people are on holiday.
The fraudulent message is then written in the house style and sent from the genuine address, sometimes as a reply inside a thread that has been running for months. There is no spoofing to detect and no lookalike domain to flag, because neither is needed.
Some operations never send anything at all from the compromised side. They simply watch, extract an invoice at the right moment, and use it from a similar domain. The reading is the valuable part, the sending is a detail.
Why the numbers are what they are
Total reported losses across all internet crime in the 2025 report came to 20.877 billion dollars across 1,008,597 complaints, up 26 percent on the year before. Business email compromise accounted for 3.05 billion of that.
Those figures understate the frequency and overstate the sophistication. The typical case is one message, one changed account number and one transfer, executed by people with no special technical skill and a rented mailbox.
The reason the average loss is large is structural. This fraud targets payments that were always going to be made, so the amount is whatever the business normally moves, and nobody questions the size of a figure they were expecting.
It also explains why small firms lose proportionally more. A company with one person handling payments has no second pair of eyes by design, and the fraud is aimed precisely at the absence of that second pair.
The four shapes it takes
Changed banking details on a real invoice. The most common and the most costly, because the invoice is genuine, the amount is right and the only altered field is the one nobody reads twice.
The urgent request from an executive. Short, apologetic, out of office, asking for a transfer to be made quietly before a deadline. It works on the hierarchy rather than on the technology.
The supplier who changed their bank. A polite notice on letterhead, often arriving weeks before the next invoice so that the change feels routine by the time it matters. Patience is what makes this one work.
The payroll redirection. Small in value, almost invisible, and often the first sign that a mailbox is compromised, because it is the test somebody runs before attempting anything larger.
Where the control actually breaks
It breaks at the point where a payment detail arrives by message and is entered by the same person who received it. Every other control in the chain can be sound and it will still fail there.
It breaks when verification uses the contact details in the message. A phone number in a signature block is not a second channel, it is the same channel wearing a different hat.
It breaks under time pressure that the sender created. Deadlines, penalties and closing windows exist in the message to remove the pause during which somebody would have checked.
It breaks quietly when a mailbox rule is filing the replies. The supplier who is chasing payment sends three increasingly worried messages and none of them reach the person who paid, which is why these cases usually surface a month later.
The callback rule that works
Any change to payment details is confirmed by voice, on a number held before the change was requested, with a person known to the caller. That sentence is the whole control and it stops the overwhelming majority of these cases.
The number comes from the contract, the purchase record or a previous verified call. Never from the message asking for the change, never from the signature block and never from a search result, since domains and directory listings can both be bought.
The call has to end with a detail the message did not contain. Ask about something ordinary and specific, such as the last invoice number or the amount of the previous payment. Somebody reading the mailbox knows the thread and does not always know the ledger.
Write the rule down and give it teeth. A control that depends on an individual feeling comfortable enough to delay a payment for the finance director is not a control, it is a hope, and it fails in exactly the situations it was written for.
What to configure in the mailbox
Alert on new forwarding rules and on rules that move messages to unusual folders. This is the single highest value detection available and most organizations still do not have it switched on.
Enforce phishing resistant sign-in for anyone who touches payments, and remove the weaker fallback rather than leaving it available. An attacker reads the list of available sign-in methods before choosing one.
Make session revocation part of any password reset. A token issued before the reset keeps working afterwards, which is how mailboxes stay compromised through the response that was supposed to fix them.
Keep a visible marker on external mail. It will not stop a message sent from a genuinely compromised internal account, and it does raise the cost of the cheaper variants that arrive from a lookalike domain.
If the payment already left
Call the bank within the hour and ask specifically for a recall on the payment. Speed matters more than completeness here, and the window during which funds can still be held is measured in hours rather than days.
Report it to the police and to the national cybercrime channel the same day. Recovery across borders depends on a formal request existing early, and a report filed a week later is usually a report filed too late.
Preserve the mailbox before anyone tidies it. Message headers, rule history and sign-in logs are what any investigation will ask for, and the natural instinct to delete the fraudulent message destroys the record.
Then check what else the intruder saw. A mailbox that was readable for weeks has exposed contracts, other suppliers and other payment schedules, and the second attempt often goes to a different company in the same thread.
Four variants, what each one asks for and what settles it
| Variant | What the message asks | What settles it |
|---|---|---|
| Changed details on a real invoice | Pay the same amount to a new account | Voice confirmation on a number held before the request |
| Urgent executive request | Transfer quietly, confirm later | Any second person in the approval path |
| Supplier changed bank | Update the payment record now, invoice follows | A call to a known contact using the contract number |
| Payroll redirection | Change the account for this month | Confirmation through the internal system, never by message |
| Quiet observation only | Nothing, the mailbox is only read | Alerting on new rules and on unusual sign-ins |
Questions and answers
- How do we tell a compromised account from a lookalike domain?
- Check the sending domain character by character against your own records. A lookalike differs somewhere, often by one letter or an added word. If the domain matches exactly, treat the account as compromised and call the counterparty.
- Is a verification email enough?
- No. A reply travels through the same mailbox the attacker is reading, and the attacker answers it. Verification has to use a different channel, and voice on a previously held number is the practical one.
- Does multi factor authentication prevent this?
- It raises the cost and does not close it. Stolen session tokens and approved device requests both produce a signed in attacker without any password being broken, which is why revocation and rule alerting matter alongside it.
- Why do these cases surface so late?
- Because a mailbox rule is hiding the replies. The supplier chases payment, the messages are filed away unseen, and the gap only becomes visible when somebody picks up a telephone.
- What is the first hour worth?
- A great deal. A recall requested within hours sometimes reaches the funds before they are moved on, while the same request a day later almost never does.
- Should the counterparty be told?
- Yes, immediately and by voice. Their mailbox may be the compromised one, and other customers of theirs are probably receiving the same message while the conversation is happening.