Invoice fraud often doesn't need malware or a clever link. It needs one convincing email and one payment that nobody double-checks. Here's how it happens, and the controls that close the gap.
BEC is a scam that targets the way businesses move money. The attacker doesn't need to break into your bank or your accounting system. They only need someone in your team to believe an email and act on it. The request is usually ordinary: pay this invoice, update this supplier's bank account, transfer this deposit before the deadline.
That ordinariness is the problem. Microsoft's own guidance notes that a BEC message can look completely legitimate while the sender is fake, and that even well-trained users struggle to tell the difference. Your defences have to work even when the email looks perfect.
Cases usually follow one of three patterns. Knowing which is which matters, because each needs a different control.
| Pattern | What it looks like | Why filters miss it | What stops it |
|---|---|---|---|
| Compromised mailbox (yours or your supplier's) | A genuine email thread, from the real address, where the bank details quietly change | It comes from a real, authenticated account | MFA, forwarding controls, call-back verification |
| Lookalike domain | An address one letter off the real one, often with copied signatures and history | The attacker owns the domain and can set up SPF, DKIM and DMARC so it passes | Impersonation protection, external sender tags, call-back verification |
| Spoofed domain | An email that shows your own or a supplier's exact domain but was sent from elsewhere | Often caught, but only if the domain owner publishes a strict DMARC policy | DMARC at p=reject on your domain; honouring DMARC on inbound mail |
Based on Microsoft's documentation of spoofing, impersonation and compromised accounts in Defender for Office 365.
The compromised mailbox is the hardest to spot. Once inside, attackers often read weeks of correspondence to learn who pays whom and when. Microsoft's investigation guidance describes them creating inbox rules that forward or hide any email containing words such as "invoice", so the real owner never sees the replies. When the next payment is due, they reply in the same thread with "updated" bank details.
Technology narrows the attack, but the control that saves the money sits in your finance process. These rules cost nothing and catch a fake request even when the email looks perfect:
If your business runs on Microsoft 365, these are the settings worth checking first. Most take minutes once you know where they are.
For a wider look at what Microsoft 365 email protection catches and misses, read Microsoft 365 Won't Stop This: The Truth About Email Security.
Training won't catch every case, but it raises the odds that someone pauses. Teach finance and admin staff to look for:
Short, regular practice works better than an annual session. Our security awareness training guide covers how to build it into the working week.
Singapore businesses pay a lot of invoices by bank transfer, often across borders, and much of that runs on email. That makes a clear payment verification process as important as any security product. It also supports your PDPA Protection Obligation and maps onto the email and access control areas of CSA Cyber Essentials.
At Cloudeli, our Cloudeli Secure package (US$28.50 per user per month on an annual plan) includes anti-phishing and malware protection for email, Teams and SharePoint, plus Microsoft Secure Score management. Cloudeli Complete (US$36.60) adds security awareness training and phishing simulations. Whatever you use, start with the free control: nobody changes bank details on the strength of an email alone.
This article is general guidance, not legal advice.
Business email compromise (BEC) is fraud in which an attacker uses a real or convincingly faked business email account to trick someone into paying money or sending sensitive information. Common versions are fake supplier invoices, requests to change bank details and urgent payment requests that appear to come from a director.
Many BEC emails contain no link or attachment, and some come from a supplier's genuine but compromised mailbox. Others use a lookalike domain that the attacker registered and set up properly, so it passes SPF, DKIM and DMARC checks. That's why payment verification steps matter as much as filtering.
Call the supplier on a phone number you already hold on file, not one in the email or on the new invoice, and confirm the change with someone you know. Have a second person approve the change in your accounting system before any payment goes to the new account.
DMARC stops attackers sending email that pretends to come from your exact domain, which protects your customers and suppliers from fake invoices in your name. It doesn't stop lookalike domains or mail from a compromised mailbox, so you still need impersonation protection and payment checks.
Contact your bank immediately and ask it to try to recall the payment, then report the case to the police. At the same time, have your IT provider check the mailboxes involved for compromise, including unknown inbox rules and forwarding, and reset passwords and sign-in sessions.
Book a free consultation. We'll check your domain's email authentication, your Microsoft 365 forwarding and impersonation settings, and walk through your payment approval steps with you.
