The attack that actually empties the account

What the numbers say

ASD's most recent Annual Cyber Threat Report, covering 2024–25, is unambiguous about where the damage is. Email compromise is the most reported cyber threat to Australian businesses. Business email compromise resulting in financial loss accounted for around 15 per cent of business cybercrime reports, with email compromise that did not produce a direct loss accounting for a further 19 per cent.

Put those together and roughly one in three cybercrime reports affecting Australian businesses starts with a mailbox.

The costs are moving in the wrong direction. ASD reported the average self-reported cost per cybercrime report rising to about $56,600 for small business, an increase of 14 per cent, and about $80,850 across businesses generally — a 50 per cent rise. Across the year ASD responded to more than 1,200 incidents and received over 84,700 cybercrime reports, which is roughly one every six minutes.

Ransomware is the thing that makes the news and the board paper. Email compromise is the thing that is statistically far more likely to happen to you, and it rarely gets discussed because nobody wants to explain how the payment went out.

Four shapes it takes

1. Invoice and payment redirection

The most common and most expensive. An attacker sits in a mailbox — yours or your supplier's — reading correspondence until they understand who pays whom, on what terms, and in what tone. Then a genuine invoice arrives with altered bank details, or a follow-up email advises that account details have changed.

Everything about it is correct. The thread is real, the invoice is real, the relationship is real, and quite often the mailbox is real. Only the account number is wrong.

2. Executive impersonation

A request to a finance staffer that appears to come from the chief executive or a director, usually urgent, usually while that person is genuinely travelling or in meetings, often asking for confidentiality until a deal completes. It works because it combines authority with time pressure and a plausible reason not to check.

3. Payroll diversion

Lower value, higher volume, and unpleasant in a different way. An email purporting to be from an employee asks HR or payroll to update their bank details before the next run. Nobody notices until the employee reports they were not paid — and the organisation still owes them the wage.

4. Supplier account compromise

The version you cannot fix with your own controls. Your supplier's mailbox is compromised and the fraudulent instruction reaches you from an entirely legitimate sender at an entirely legitimate domain. Your email security has nothing to object to, because there is nothing wrong with the email.

Why your stack does not see it

Organisations are frequently surprised that a well-funded security stack did not catch this. It did not catch it because there was nothing for it to catch.

• No malware. No attachment to detonate, no payload to sandbox, no endpoint behaviour to flag.
• Legitimate credentials. The attacker signed in as a real user, usually after an adversary-in-the-middle phish that captured a session — so multi-factor authentication was satisfied.
• Legitimate mail flow. Messages originate from a real tenant with valid SPF, DKIM and DMARC, because they are being sent by the tenant.
• Human-plausible content. The wording matches the thread. Increasingly it matches the writer's style, because the attacker has read months of their mail.

This is not a malware problem wearing a disguise. It is a fraud problem that happens to arrive by email, and it needs to be treated as one.

The technical controls

1. Phishing-resistant MFA for anyone who can move money, and for anyone with administrative rights. Number matching stops push fatigue but does not stop a session being relayed through a proxy. FIDO2 keys or Windows Hello for Business do.
2. Alert on mailbox rule creation. This is the single highest-value detection available and most organisations do not have it switched on. Attackers almost always create a rule to hide their tracks — moving replies to Deleted Items, RSS Feeds or an obscure subfolder so the real user never sees the conversation. A new rule containing terms like "invoice", "bank", "payment" or "urgent" is close to a definitive signal.
3. Block or alert on external auto-forwarding. The other standard persistence move, and one that keeps working after a password reset.
4. Enforce device compliance in conditional access. A relayed session token replayed from an unmanaged machine offshore fails a policy that requires an enrolled, compliant device.
5. Tag external mail clearly, and make impersonation protection cover your executives and finance team by name.
6. Publish DMARC at enforcement. It will not stop a compromised real mailbox, but it stops the easier attack where somebody simply spoofs your domain at your customers.
7. Practise session revocation. Resetting a password does not evict an attacker holding a live token. Revoking sessions is a separate, deliberate step.

The control that actually stops it

Every technical control above is worth having, and none of them is the answer. The supplier-compromise case defeats all of them, because the email is genuine.

The control that works is procedural and almost embarrassingly simple:

No bank account detail is ever created or changed on the strength of an email. It is verified by a phone call to a number you already held — never a number from the email — and the verification is recorded against the payment.

Alongside it, two supporting rules. Dual authorisation for new payees and for any change to existing bank details, so no single person can be socially engineered into moving money. And an explicit standing instruction that urgency and confidentiality are the two strongest reasons to slow down, not to hurry — stated by the executive team, so a finance officer who delays a "CEO" request is doing exactly what they were told to do.

That last part matters more than it sounds. Most payment fraud succeeds because a junior staff member did not feel able to question a senior one. That is a culture problem you can fix in a meeting, and it costs nothing.

If it has already happened

Speed is the only variable you control, because recovery depends almost entirely on whether the funds have moved on.

1. Call your bank immediately and ask for a recall. Same day is materially different from next morning.
2. Report to ReportCyber, and notify your insurer and broker.
3. Contain the mailbox: revoke sessions, reset credentials, and audit for forwarding rules and inbox rules the attacker created.
4. Work out what was read, not just what was sent. A mailbox sitting open for six weeks is a data breach question as well as a fraud question, and may trigger notification obligations.
5. Warn your counterparties. If the attacker was in your mailbox, your clients and suppliers are the next targets, and they will hear about it from you or from the fraud.

Figures cited are from ASD's Annual Cyber Threat Report 2024–25, the most recent published at the time of writing.