Payment-redirection fraud — a form of business email compromise — is simple and effective. An attacker sends a convincing message asking you to change the bank account for an invoice, payroll deposit, settlement or supplier payment. The money goes to the attacker, and recovering it is often difficult.

These attacks succeed because they look like normal business. The message may come from a real supplier’s compromised mailbox, or from an executive’s account that an attacker has quietly controlled for weeks.

Start with one rule: verify every payment change

The most effective control is procedural. Any request to change payment details must be verified by phone, using a number you already have on file — never one included in the request. Make this a written rule, apply it to everyone including executives, and tell suppliers and clients that you follow it.

Make account takeover harder

  • Require MFA everywhere, with stronger methods for finance staff and executives.
  • Use Conditional Access to restrict sign-ins from unmanaged devices or unusual locations where your licensing allows.
  • Block external auto-forwarding so a compromised mailbox cannot silently copy mail to an attacker.

Make impersonation easier to spot

  • Turn on impersonation protection in Microsoft Defender for Office 365 for executives, finance staff and key suppliers.
  • Tag external email so staff can see when a message that looks internal actually came from outside.
  • Publish DMARC for your own domain to reduce direct spoofing.

Watch for the signs of compromise

Attackers who control a mailbox often create inbox rules that hide replies, sign in from unfamiliar locations or register new MFA methods. Monitoring for these signals — through managed detection and response or your own security team — can catch an attack before a fraudulent request is sent.

If a payment has already been redirected

  1. Contact your bank immediately and ask them to attempt a recall.
  2. Report the incident to the FBI’s Internet Crime Complaint Center (IC3).
  3. Contact your cyber insurer, which may require specific steps or providers.
  4. Secure the affected accounts and preserve evidence before deleting messages or rules.

Prevention is cheaper than recovery

A verification rule costs nothing. The technical controls above are included in many Microsoft 365 plans but are often not configured. If you would like help reviewing your exposure, talk to Simba Cyber.