Business Email Compromise: The $80,000 Fraud Most Australian SMBs Don’t See Coming

An email lands in your accounts payable inbox. It’s from your regular supplier, requesting a bank account update for future payments. The email looks exactly right – the sender’s name, the logo, the tone. Your team updates the details and processes the next invoice. Three weeks later, your real supplier calls asking why they haven’t been paid. The money is gone, transferred to a fraudster’s account overseas. This is **Business Email Compromise** – and it is one of the most financially devastating cybercrimes targeting Australian businesses right now. This article explains how it works, why it’s so effective, and what your business must do to avoid it. What Is Business Email Compromise? **Business Email Compromise (BEC)** is a sophisticated form of cybercrime in which attackers impersonate a trusted entity – typically a CEO, senior executive, supplier, or business partner – to manipulate staff into transferring funds, sharing sensitive data, or taking actions that benefit the attacker. Unlike ransomware, BEC attacks often involve no malware at all. They are entirely social engineering operations – exploiting human trust rather than technical vulnerabilities. This is precisely what makes them so dangerous: your antivirus and firewall are largely irrelevant. The most common BEC scenarios include: – **Fake invoice fraud:** Impersonating a supplier to redirect payment to a fraudulent account – **CEO fraud:** An “urgent” email from the CEO instructing an employee to make an immediate wire transfer – **Payroll diversion:** Impersonating a staff member to request a payroll bank account change – **Attorney impersonation:** Posing as a lawyer handling a confidential transaction requiring urgent payment – **Account takeover BEC:** Attackers compromise a genuine business email account and send fraudulent instructions from the real address Why BEC Attacks Are So Effective Against SMBs Small and medium businesses are disproportionately targeted by **Business Email Compromise** for several reasons: – **Fewer verification controls:** Larger organisations often require dual approvals or verbal confirmation for payment changes. SMBs frequently don’t. – **Higher trust between staff:** In a small team, an email from the boss requesting urgent action is more likely to be acted on without question – **Less security awareness training:** Staff in SMBs are less likely to have been trained to recognise BEC indicators – **Public information availability:** LinkedIn, company websites, and social media make it easy for attackers to understand your org structure, supplier relationships, and communication patterns Attackers invest significant time in reconnaissance before sending a BEC email. They study your domain, your language, your relationships, and your processes – making their impersonation convincingly accurate. The Technical Controls That Reduce BEC Risk While BEC is fundamentally a social engineering attack, technical controls provide important layers of defence: **Email Authentication: SPF, DKIM, and DMARC** These DNS records verify the legitimacy of emails sent from your domain and – critically – tell receiving mail servers what to do with emails that fail authentication. A properly configured DMARC policy prevents external parties from successfully spoofing your domain to your own staff or suppliers. **Advanced Email Filtering** Next-generation email security solutions scan inbound emails for display name spoofing (where the sender name looks right but the email address doesn’t), lookalike domain attacks, and known BEC patterns. Many BEC attempts are stopped at this layer. **Multi-Factor Authentication on Email** Preventing attackers from accessing genuine email accounts reduces account takeover BEC. MFA is essential on all Microsoft 365 and Google Workspace accounts. **Banner Warnings for External Emails** Configuring your email platform to display a visible banner on all emails originating from outside your organisation creates a consistent visual cue that prompts staff to scrutinise unexpected requests more carefully. The Process Controls That Matter Just as Much Technical controls alone are not enough against BEC. **Process controls** are equally critical: – **Verbal verification for payment changes:** Any request to change bank account details – regardless of how legitimate the email looks – must be verified by calling the supplier on a phone number already on record (not one provided in the email) – **Dual approval for high-value transfers:** Require two authorised staff members to approve any transfer above a defined threshold – **Pause and verify culture:** Train staff to treat urgency in financial requests as a red flag, not a reason to act faster – **Clear BEC reporting pathway:** Staff who receive suspicious requests should know exactly who to contact and should never feel embarrassed to raise a concern Is Your Microsoft 365 Environment Actually Secure? –https://www.netlogyxitcom.au/blog/microsoft-365-security BEC Attacks Are Getting More Sophisticated. Is Your Business Ready? At **Netlogyx Technology Specialists**, we help businesses across the Gold Coast, Brisbane, and SE Queensland build the technical and human defences that stop **Business Email Compromise** before it causes financial damage. Our BEC protection approach includes: – SPF, DKIM, and DMARC email authentication setup and monitoring – Advanced email filtering with display name spoofing detection – MFA enforcement across all email platforms – Staff awareness training with BEC-specific simulation scenarios – Documented payment verification process development – Ongoing dark web monitoring for compromised credentials Book a Free Discovery Session Today *We’ll assess your current email security configuration and identify your BEC exposure.* Frequently Asked Questions **Q: If the attacker is using a lookalike domain (not my actual domain), can I still stop it?** A: Yes, to a significant degree. Advanced email filtering solutions detect lookalike domain attacks (such as “netlogyx.com.au” being impersonated by “net1ogyx.com.au”) and either block or clearly flag these emails. Combined with staff training to verify unusual requests verbally, the risk from lookalike domain attacks is substantially reduced. DMARC protects your own domain from being spoofed – complementary controls cover the lookalike risk. **Q: Can cyber insurance cover BEC losses?** A: Some cyber insurance policies cover BEC-related losses under social engineering fraud clauses, but coverage limits and conditions vary widely. Many policies require evidence of security controls (MFA, email authentication) as a condition of BEC coverage. Always review your policy carefully and confirm coverage terms with your broker. **Q: Is BEC only a risk for our finance team?** A: No. While finance teams