Business email compromise (BEC) and payment diversion fraud

What it is

Guidance from the National Crime Agency and City of London Police describes payment diversion fraud, also known as business email compromise or mandate fraud, as criminals impersonating others, creating or amending invoices and diverting payments to bank accounts under their control. It targets businesses and individuals.

It usually arrives in one of two ways:

• A spoofed or look-alike address, made to appear to come from your supplier, your client or your own managing director
• A genuine account that has been taken over, where the criminal reads real email threads and replies at exactly the right moment, often after setting up a hidden rule that forwards or hides messages

Either way, the request looks routine: a supplier’s “new bank details”, an urgent payment from the boss, or a client’s completion funds sent to the wrong account.

Why it matters for a UK small or regulated business

The guidance says small and medium-sized businesses are particularly vulnerable because they often have less comprehensive IT security, and that people buying property and making large transactions are also at risk. For law firms, conveyancers, IFAs and mortgage brokers, a diverted client payment is both a financial loss and a regulatory problem.

The warning signs it lists are an urgent request for a large or unusual payment, a request to change an existing supplier’s bank details or set up a new one, language that doesn’t sound like the real sender, and spelling mistakes in the message or address. Its main advice is to double-check any payment request by another method, using contact details from a different source, such as a phone call to a number you already hold. If in doubt, don’t send the money. If you think you have been caught out, call your bank immediately and report it to the police national fraud reporting service.

How it works in Microsoft 365

No setting replaces a call-back process, but several make BEC much harder:

• MFA on every mailbox, ideally phishing-resistant for finance staff, so accounts are harder to take over
• DMARC, SPF and DKIM, which Microsoft notes help prevent the spoofed senders used in BEC
• Blocking automatic forwarding to external addresses and checking mailboxes for unexpected forwarding rules
• Microsoft’s anti-phishing and impersonation protection

How &DEV helps: our cyber assurance uplift for regulated firms puts these controls in place for firms that handle client money, and the Microsoft 365 MOT covers them for general small businesses.