Phishing and Business Email Compromise Defence

Ransomware gets the headlines, but business email compromise quietly inflicts enormous financial damage on Australian organisations, often without a single piece of malware involved. BEC is fraud by deception: an attacker convinces someone in your organisation to send money or data to the wrong place, using a trusted email account they have either compromised or convincingly faked. Because it exploits human trust rather than software flaws, it routinely slips past purely technical defences.

Defending against phishing and BEC therefore demands layers, technical controls, process controls and people, working together. Relying on any single layer is how organisations end up wiring six-figure sums to criminals. This guide sets out a defence that actually holds.

Understand how the attack really works

Most serious BEC follows a recognisable pattern. It often starts with phishing: a staff member is lured into entering their credentials on a fake login page or approving a malicious MFA prompt. The attacker now has access to a genuine mailbox. Crucially, they do not rush. They sit quietly, reading emails to learn how the organisation communicates, who approves payments, which suppliers are owed money and what an invoice looks like.

Then they strike. They might insert themselves into a real invoice thread and quietly change the bank details. They might impersonate an executive demanding an urgent, confidential transfer. They might set up hidden mailbox rules that auto-delete the supplier’s genuine emails so the fraud is not noticed. The hallmark is patience and authenticity, which is exactly why a suspicious email filter or a single training session will not save you.

Layer one: harden email and identity

Technical controls reduce both the volume of malicious email reaching staff and the chance an account can be hijacked. The essentials:

• SPF, DKIM and DMARC configured and enforced on your domain, so attackers cannot easily spoof your address to your own staff, customers or suppliers. A DMARC policy set to reject is the goal.
• Advanced email filtering and link protection that inspects attachments and rewrites links to catch malicious destinations at click time.
• Phishing-resistant MFA on every account. Standard MFA is far better than nothing, but attackers increasingly defeat push-based or one-time-code MFA through fatigue prompts and real-time phishing proxies. Passkeys and FIDO2 security keys resist these techniques and should be your target, especially for executives and finance staff.
• Monitoring for risky activity, including new mailbox forwarding rules, impossible-travel logins and mass email access, which are strong signals of a compromised account.

These controls align with the multi-factor authentication and hardening expectations in the Essential Eight, and getting them right pays dividends well beyond BEC alone.

Layer two: make your payment process the safety net

This is the layer organisations most often neglect, and it is the one that stops BEC even when an account has been compromised. The principle is simple: never change payment details or release funds on the strength of an email alone.

1. Verify out of band. Any request to change bank details or make an unusual payment must be confirmed by phoning the supplier or requester on a number you already hold, never a number supplied in the email itself.
2. Enforce dual authorisation for payments above a sensible threshold, so no single compromised account or coerced individual can move money alone.
3. Treat urgency and secrecy as red flags. Genuine business rarely requires a confidential transfer that must happen in the next hour and cannot be discussed. Attackers manufacture pressure precisely to short-circuit your checks.
4. Lock down supplier bank-detail changes with a defined, verified process that finance staff cannot be talked out of following.

A robust payment process is the difference between an attacker who breaches a mailbox and an attacker who actually gets paid. It costs little and prevents the most damaging outcome.

Layer three: build genuine staff awareness

People are not the weakest link to be blamed; they are a control to be supported. The goal is not to shame staff who click, but to build an environment where suspicious messages are reported quickly and verifying a request is seen as professional, not paranoid.

Effective awareness includes regular, realistic phishing simulations that teach rather than punish, clear and frictionless reporting (a one-click report button works well), and targeted coaching for high-risk roles such as finance, executive assistants and senior leaders who are the prime targets of impersonation. Measure the rate at which staff report suspicious emails, not just the rate at which they click, because reporting is what gives your responders an early warning.

Know the variants you are defending against

BEC is not a single attack but a family of related frauds, and recognising the patterns helps staff and finance teams spot them. The most common in Australian organisations include:

• Invoice and supplier fraud, where an attacker either compromises a supplier’s mailbox or spoofs it, then sends a legitimate-looking request to update bank details before an invoice is paid. This is the highest-value variant because the amounts mirror genuine trade.
• CEO or executive impersonation, where a message appearing to come from a senior leader pressures a junior staff member into an urgent, confidential transfer or gift-card purchase.
• Payroll diversion, where an attacker impersonates an employee to redirect their salary to a new account.
• Conversation hijacking, where the attacker inserts replies into a real, ongoing email thread, lending the fraud powerful authenticity because the context is genuine.

Notice that several of these do not require compromising your systems at all; spoofing and look-alike domains can carry the fraud externally. That is precisely why process controls, not just account security, are the decisive defence.

Watch for the early warning signs

A compromised mailbox usually leaves traces before the fraud completes. Equip your team and your monitoring to catch them:

• New or hidden mailbox forwarding and deletion rules, a classic attacker technique to intercept replies and hide their tracks.
• Logins from unexpected locations or impossible-travel patterns, signalling stolen credentials in use.
• Look-alike domains, where a single transposed or substituted character mimics a supplier or your own domain.
• Subtle changes in tone, timing or payment requests within an otherwise familiar thread.

Surfacing these signals is part of broader detection and response, and even modest monitoring of identity and email activity dramatically shortens the window in which a hijacked account can do damage.

When it goes wrong: responding to BEC

Even strong defences are occasionally beaten, so a fast, rehearsed response matters. If you suspect a fraudulent payment has been made:

• Contact your bank’s fraud team immediately to attempt a recall. Funds move quickly and the first hours are decisive.
• Preserve evidence, including the relevant emails, headers and access logs, before anything is deleted.
• Contain the account, resetting credentials, revoking sessions and removing any malicious mailbox rules the attacker created.
• Report and assess obligations, including notifying ReportCyber and evaluating whether the incident triggers notifiable data breach requirements.
• Review and improve, understanding exactly how the fraud succeeded and closing that specific gap.

A clear, tested incident response plan turns a panicked scramble into a controlled process, and the speed it enables can be the difference between recovering funds and losing them.

Pulling the layers together

No single product stops business email compromise. It is defeated by overlapping defences: hardened email and identity, payment processes that assume an email might be fraudulent, and staff who report rather than react. Getting that combination right, and keeping it right as attackers evolve, benefits from experienced security leadership. A virtual CISO can assess your exposure, prioritise the controls that matter most and embed the processes that turn awareness into resilience, across both the private sector and government and council settings.

If your organisation has suffered a BEC incident, or you want to pressure-test your defences before one occurs, CISO Advisory provides Australia-wide support around the clock. Call 07 2112 8502 or reach us via our contact page, with on-site help available same day or next business day.