Every piece of security advice you’ve absorbed over the years points in the same direction: be wary of strangers, don’t trust unsolicited messages, hover over links before you click. It’s not bad advice. It’s also not what caught the business owner who called me this week about what turned out to be a business email compromise, because he wasn’t careless with a stranger. He did the thing every business is told to do. He built a connection, took the meeting, followed up on a prospect. The failure wasn’t a lapse in caution. It was ordinary business behavior, working exactly as intended, aimed at someone who had done nothing wrong by any standard we usually teach.<\/p>\n
He called me rattled by a phone call from one of his own clients, confirming a change to the routing and account number on an invoice. He hadn’t changed anything. He hadn’t sent anything. The invoice was for fifty thousand dollars, and the client hadn’t paid it. He’d called first.<\/p>\n
He walked me through it in order, and I knew where the story was going before he finished a sentence. The invoice matched the original exactly, in every detail, except for the routing and account numbers, which meant whoever sent the update had the real one in hand. That meant his email. A new contact he’d made on LinkedIn a few weeks earlier had been sitting in the back of his mind, though he wasn’t sure how or why it connected. A handful of conversations, information shared back and forth, both sides feeling out whether there was business to be done.<\/p>\n
At one point the contact sent over a document. The email offered two ways to open it: click here for Office, click here for Google. He clicked, was asked to log in to view the file, and did. He read the document, the exchange continued a little longer, then slowed the way most of these early conversations do, and settled into the obscurity most new connections drift into.<\/p>\n
Whoever took his credentials that day didn’t do anything with them right away. They read.<\/p>\n
Eventually they found that fifty-thousand-dollar invoice, changed the routing and account number, and sent it again from his real address, in his real sent history, with nothing else altered. It very nearly worked. It didn’t, because his client wasn’t willing to move that much money on an email alone and picked up the phone to confirm it first. That instinct isn’t guaranteed, and it isn’t evenly distributed. A smaller business moving a smaller amount is arguably more exposed to exactly this scheme, not less, because a four-figure change rarely earns the same scrutiny as a five-figure one.<\/p>\n
Business email compromise was the second-costliest category of cybercrime the FBI tracked in 2025, behind only investment fraud, according to the FBI’s Internet Crime Complaint Center 2025 Annual Report<\/a>. It is not a rare or unusual scheme. It is one of the most common ways businesses lose money to fraud right now.<\/p>\n The instruction that actually would have stopped this has nothing to do with strangers. It’s simpler and less intuitive: never enter your email credentials into a login page a document link sends you to, regardless of who sent it or how legitimate the relationship feels. The login prompt is the entire attack. Everything after it is just the intruder patiently waiting for something worth taking.<\/p>\n His account did not have multi-factor authentication turned on. That’s worth fixing regardless of this story, since MFA still stops the overwhelming majority of ordinary credential attacks. But it’s worth being honest that MFA alone would not have stopped this particular one. The login page involved here was built to sit in the middle of the real sign-in process, which is a more advanced kind of attack than the one MFA was designed to stop.<\/p>\n If you’re wondering whether an account of yours may already be exposed, here’s how do I know if my email has been hacked and what to do next<\/a>.<\/p>\n It’s a conversation worth having with everyone in your business.<\/p>\n Until next time, keep IT simple.<\/p>\n Dave<\/p>\n