Business email compromise is the mid-market breach

Ask a mid-market executive what cyber incident keeps them up at night and they will say ransomware. Ask what incident their organization has actually experienced and the answer is usually a compromised mailbox.

Business email compromise (BEC) does not encrypt anything. It does not announce itself. It is an attacker reading a finance manager’s inbox for three weeks, learning how invoices are approved, and then sending a payment instruction that looks exactly like the last fifty. The FBI’s Internet Crime Complaint Center has reported BEC losses in the billions of dollars every year for the better part of a decade, consistently among the costliest categories it tracks.

In the organizations Sidechain works with, from law firms to medical practices to lenders, BEC and its precursors account for most of the incidents we investigate. This article covers how it works and the handful of controls that stop it.

How it works

Step one: get into a mailbox. Usually through a phishing email that leads to a convincing sign-in page. The user enters their credentials. If there is no multi-factor authentication, the attacker is in. If there is MFA, the attacker may use a proxy that relays the MFA prompt in real time, or simply wait for a user who approves push notifications without looking.

Step two: stay quiet. The attacker creates inbox rules that forward or hide messages: anything containing “invoice,” “payment,” or “wire” goes to a folder the user never sees. They read. They learn names, approval chains, vendors, and tone.

Step three: act. The attacker sends an email from the real mailbox, or from a lookalike domain registered a week earlier, with new banking details for a real vendor, or an urgent request from the CEO for a wire, or a changed payroll direct deposit. Because it comes from a legitimate account, with real context, through a conversation that already exists, it passes every human check.

Step four: cash out. The money moves to an account the attacker controls and is gone within hours.

Why mid-market organizations are the target

Large enterprises have segregation of duties, payment verification procedures, and security teams watching for inbox rules. Very small businesses do not move enough money. The mid-market has the money, the vendor relationships, and finance teams of three people who approve payments over email because that is how it has always worked.

The controls that stop it

None of these are exotic. All of them are things we deploy in the first month of a managed program.

Multi-factor authentication, phishing-resistant where possible. MFA on every account, without exceptions for executives. Where the organization can support it, move to phishing-resistant methods (FIDO2 security keys, passkeys, or Windows Hello) for finance, executives, and administrators, because push-based MFA can be relayed or fatigued. In Microsoft 365, Conditional Access can require it by role and block legacy authentication protocols that bypass MFA entirely.

Email authentication: SPF, DKIM, and DMARC. These three records make it hard for an attacker to send email that appears to come from your domain. DMARC with an enforcement policy is the one most organizations have not finished. It is also what prevents your own domain from being used to defraud your customers.

Inbox rule and forwarding monitoring. Alert on new inbox rules that forward externally, delete messages, or move them to obscure folders. This is one of the highest-signal detections in all of security, and it is nearly free.

Impersonation and lookalike domain protection. Email security platforms can flag messages from domains that resemble yours or your vendors’, and messages where the display name matches an executive but the address does not.

Out-of-band payment verification. The control that works even when everything else fails: any change to payment details, any new vendor, and any wire above a threshold is confirmed by phone to a known number. Not a number in the email. This is a finance procedure, not a technology, and it should be written down and tested.

Security awareness training with reporting. Employees who know what BEC looks like and have an easy way to report a suspicious message are a detection layer. Reported phishing should be investigated, and the person who reported it should hear back.

Monitoring and response. When a mailbox is compromised, speed matters. A managed program that watches sign-in anomalies, impossible travel, new MFA registrations, and mail rule changes, and that has a procedure for resetting credentials, revoking sessions, and reviewing what the attacker touched, turns a potential wire fraud into a reset and a report.

A note on Microsoft 365

Most of the organizations we work with run Microsoft 365, and most of them are paying for security features they have not turned on. Conditional Access, Defender for Office 365, Secure Score recommendations, and audit logging are all available at common license tiers. A Microsoft 365 security audit typically finds a short list of configuration changes that close most of the BEC exposure without buying anything new.

Where to start

If you do one thing this week, confirm that MFA is enforced for every account with no exceptions, and that legacy authentication is blocked. If you do two, publish a DMARC record and move it toward enforcement. If you do three, write down the payment verification procedure and make sure finance has read it.

Sidechain’s managed security program includes email security, identity protection, 24/7 monitoring, and awareness training, run by a named engineer who will know your environment when something happens.