By PC Madness ·
The short answer
Phishing is a message that pretends to come from someone you trust, such as a bank, a supplier, Microsoft or your own boss, to get you to click a link, open a file or hand over a password. Business email compromise (BEC) is what often comes next: a scammer uses a hacked or lookalike email account to trick a business into paying a fake invoice, changing bank details or sending goods.
Neither needs clever hacking. They work by abusing trust and normal business routines. That's good news, because the same red flags show up again and again, and a few simple checks stop many of them. This article lists the warning signs, explains how BEC scams usually play out, and sets out what to do if you think one has got through.
Red flags in a phishing message
The ASD's Australian Cyber Security Centre lists common warning signs of phishing. In a small business inbox, they usually look like this:
- It's unexpected. A delivery notice for something nobody ordered, a shared document from someone you don't usually work with, or a voicemail email when your phones don't send them.
- It's urgent or threatening. Your account will be closed today, a fine is overdue, or a payment must go out before the end of the day.
- It asks for a login or a code. A link to "verify your account" that opens a sign-in page, or someone asking you to read out a multi-factor authentication code.
- The sender's address is slightly off. The display name says your supplier, but the address behind it is a free webmail account or a domain with one letter changed.
- The links or attachments don't fit. Hover over a link (or press and hold on a phone) and the real address points somewhere unrelated. An invoice arrives as an unusual file type or a zip.
- It asks you to skip a normal step. "Don't call, I'm in a meeting", or a request to keep something quiet from the rest of the team.
Poor spelling and generic greetings like "Dear customer" are still worth noticing, but don't rely on them. Many phishing emails are well written and use real logos, and targeted ones (spear phishing) use your name, your role and the names of people you actually deal with.
It isn't only email
The same tricks arrive by text message, social media, messaging apps and phone calls. Two variations are worth knowing by name. Quishing uses a QR code instead of a link, so you can't see where it goes before you scan it, and staff often scan it with a personal phone that has none of the business's protection. Vishing is phishing by phone, where caller ID can be faked and voice-cloning tools can make a caller sound like someone you know.
The rule is the same for every channel: if a message or call creates pressure to act now, stop and check it another way.
How business email compromise works
The ACSC's guidance on protecting against business email compromise describes three common versions:
- Invoice fraud. A scammer gets into a supplier's mailbox, takes a real invoice, changes the bank details and sends it to the supplier's customers from the genuine account. The customer pays what looks like a normal bill, and the money goes to the scammer.
- Employee impersonation. A scammer uses a hacked or lookalike account to pose as someone senior and asks for an urgent payment, or poses as a staff member and asks payroll to change their bank account so the next pay goes to the scammer.
- Company impersonation. A scammer registers a domain very close to a well-known organisation's, orders expensive goods such as laptops on credit and has them delivered, leaving the real organisation to receive an invoice for goods it never ordered.
Invoice fraud is the hardest to spot, because the email really does come from the supplier's account and may reply to a genuine conversation. That's why the checks below focus on the request, not just the sender.
The red flags of a BEC scam
The ACSC suggests making sure staff know these warning signs:
- an unexpected change of bank details
- an urgent payment request, or threats of serious consequences if payment isn't made
- an unexpected payment request from someone in a position of authority, especially if they don't usually make requests like it
- an email address that doesn't look quite right, such as a domain name that doesn't exactly match the supplier's company name
Add a few of your own based on how your business works: a request that arrives just before a long weekend, a new supplier who wants payment before the usual paperwork is done, or a staff member asking for a pay change only by email.
Simple checks that catch fake payment requests
Against BEC, a simple business process does more than any single piece of software. The ACSC recommends a clear, consistent process for checking requests involving payments, account changes and sensitive information. For a small business, that usually means:
- Any change to a supplier's or employee's bank details is confirmed by phone, using a number you already had on file or from the organisation's official website, never one in the email.
- Larger or unusual payments need a second person to approve them.
- Staff are told, in writing, that they will never be in trouble for slowing down a payment to check it, even if the request appears to come from the owner.
- Everyone knows how to report a suspicious message, and does it.
Technology helps too. Multi-factor authentication makes it much harder for a stolen password to turn into a hacked mailbox. SPF and DMARC records on your domain help email providers detect messages that pretend to come from you. Email filtering catches a lot before it reaches anyone. None of these replaces the phone call, though, because invoice fraud can come from a real, compromised account.
What to do if you think one got through
If a payment or bank details have gone to a scammer, the ACSC's advice is to act as soon as possible:
- Contact your bank immediately and ask them to try to stop or recall the payment.
- Report the cybercrime to ASD through cyber.gov.au.
- If an email account was compromised, change its password, tell anyone who may have been affected and consider a warning notice on your website so customers know to ignore the fake messages.
Also check the compromised mailbox for forwarding rules or sign-in methods the scammer may have added, and turn on multi-factor authentication if it wasn't already on. If personal information may have been exposed, get advice on whether you need to notify anyone.
How we help
Our security awareness training sends staff safe, simulated phishing emails based on real attacks such as fake invoices, with instant coaching for anyone who clicks. Our Microsoft 365 email security adds a protection layer on top of Microsoft's and Google's built-in filtering to stop phishing and impersonation emails before they reach an inbox, and dark web monitoring warns you when staff logins turn up in a data breach.
Not sure how your team would handle a fake invoice? Send us a message to book a free, obligation-free IT security audit, and we'll check your email protection, multi-factor authentication and payment processes.
