Business Email Compromise: How One Phished Password Costs UK Firms Real Money

The most expensive incident a UK small business is likely to suffer is not ransomware.

It is an attacker reading email for six weeks and then sending one message.

How it actually unfolds

Someone clicks a convincing sign-in page and enters their Microsoft 365 password. If multi-factor

authentication is not enforced — or is enforced but bypassable through a legacy protocol — the

attacker now has a working mailbox.

They do not do anything dramatic. They create a mailbox rule that quietly moves messages containing

words like "invoice", "payment" or "bank" into an obscure folder, or forwards them out. Then they

read. They learn who your suppliers are, how you word your emails, what your payment cycle looks

like, and who authorises what.

When a genuine invoice comes through, they intervene. Sometimes they reply from the compromised

account with amended bank details. Sometimes they register a near-identical domain and continue the

thread from there. Either way, the message arrives in a real conversation, in the right voice, at

exactly the moment a payment was expected.

Why technical controls do not catch it

There is no attachment to scan and no link to sandbox. The email comes from a genuine account or a

plausible domain, in an existing thread, and asks for something entirely normal. Every automated

control you own is looking for anomalies, and there is not one.

That is why the defence has to be procedural.

The control that works

Never change bank details on the strength of an email. Verify every change by calling the supplier

or client on a number you already held — not one in the email, not one in the signature, not one on

a document attached to the message.

That single rule defeats the entire attack, because the attacker controls the message but not the

telephone number you had on file six months ago.

• Confirm bank details once, early, by telephone, and record that you did
• State in your terms and client care letters that details will never change by email
• Require a second person to authorise any late change to payment instructions
• Treat urgency as a red flag rather than a reason to hurry
• Brief your finance team specifically — they are the target

The technical controls that reduce exposure

Process stops the payment. Technology reduces how often you are in the position at all.

1. Multi-factor authentication on every mailbox, with legacy authentication protocols blocked so it

cannot be bypassed

1. Alerting on new mailbox rules and any external auto-forwarding — this is the single highest-value

detection available to a small business

1. SPF, DKIM and DMARC configured to enforcement, so criminals cannot send convincing invoices that

appear to come from your domain

1. Conditional access policies restricting sign-in by location or device risk
2. Unified audit logging enabled with adequate retention, so an investigation is possible at all

If it has already happened

Move fast and in this order. Reset the password and revoke all active sessions — a password reset

alone leaves an existing session token working. Remove any mailbox rules the attacker created. Check

whether any payments have gone out and contact your bank immediately, because same-day recall is

sometimes possible and next-week recall almost never is.

Then work out what was accessed. If the mailbox contained personal data — and mailboxes almost

always do — you may have a reportable breach, and the ICO clock runs for 72 hours from the moment

you became aware.

Do not delete the mailbox rules before recording them. They are evidence of what the attacker was

targeting, and you will want that detail both for the investigation and for the notification.