Your business email account is probably one of the most important tools you use every day. It’s where you communicate with customers, receive invoices, share documents, manage supplier relationships and access information about the day-to-day running of your business. But have you ever considered just how much information someone could access if they managed to get into your email account? For cyber criminals, a compromised business mailbox can be incredibly valuable. And the consequences can go far beyond someone simply reading your emails.
From fraudulent payment requests to impersonating trusted colleagues, a single compromised account could put your business, customers and suppliers at risk.
So, what actually happens when a cyber criminal gains access to a business email account, and how can you protect your organisation?
It Starts With One Compromised Account
Cyber criminals don’t always need sophisticated hacking techniques to access business systems. Sometimes, all they need is a username and password. Login credentials can be stolen through phishing emails, fraudulent websites, malware or reused passwords that have been exposed in previous data breaches.
Once an attacker has obtained valid credentials, they may attempt to log in to the account as though they were the legitimate user. Without appropriate security measures, such as multi-factor authentication (MFA), a stolen password could be enough to gain access. And once they’re inside, the real problems can begin.
Your Inbox Reveals More Than You Think
Imagine someone gaining access to your business email account. They might be able to see who you regularly communicate with, which suppliers you use, what invoices are outstanding and who within your organisation is responsible for approving payments. They may also find confidential documents, customer information and details about ongoing projects.
In some cases, attackers deliberately spend time reviewing emails and learning how a business operates before attempting fraud.
They might look for:
- Financial conversations: invoices, payment requests and discussions about bank details.
- Trusted contacts: colleagues, customers and suppliers who regularly communicate with the account holder.
- Business processes: how payments are approved and who has the authority to make decisions.
- Sensitive information: confidential attachments, personal information or commercially valuable documents.
- Access to other systems: password reset emails and notifications from connected business applications.
This information can help an attacker create convincing messages that appear to be part of an ordinary business conversation. And that’s where business email compromise becomes particularly dangerous.
What Is Business Email Compromise?
Business email compromise, often shortened to BEC, is a type of cyber-enabled fraud in which criminals impersonate trusted individuals or organisations to manipulate people into transferring money, sharing sensitive information or taking other actions.
Sometimes criminals use email addresses designed to look almost identical to genuine ones. In other cases, they gain access to a legitimate account and send messages directly from it. This can make fraudulent requests particularly difficult to identify.
After all, if an email appears in an existing conversation with a supplier you’ve worked with for years, you may have little reason to question it. But that’s exactly the trust criminals are attempting to exploit.
The Invoice That Wasn’t Quite Right
Consider a small business that regularly receives invoices from the same supplier. One afternoon, an email arrives requesting payment of an outstanding £10,000 invoice. Everything looks normal. The sender’s name is familiar, the email address is correct and the message refers to a genuine invoice. There’s just one difference.
The supplier’s bank details have changed.
The email explains that payments should now be sent to a new account. An employee processes the payment, believing they’re following a legitimate instruction. Unfortunately, the message was sent by a criminal who had gained access to the supplier’s email account. By the time the fraud is discovered, the money may already have been transferred.
This is one example of how business email compromise can work. Rather than relying on an obviously suspicious message, attackers exploit existing relationships and familiar business processes. The good news is that relatively straightforward procedures can help reduce this risk.
For example, any request to change supplier bank details should be independently verified using a trusted telephone number or contact method already held on file, rather than contact information supplied in the email itself. That extra check could make a significant difference.
One Compromised Account Can Affect More Than One Business
The consequences of email compromise aren’t necessarily limited to the organisation whose account was accessed. If a criminal gains control of a genuine business mailbox, they may use it to send malicious messages to other people.
That could include:
- Sending fraudulent invoices to customers
- Requesting confidential information from colleagues
- Distributing malicious links or attachments
- Impersonating senior employees to authorise payments
- Targeting suppliers using existing email conversations
Because these messages may come from a genuine email address, recipients can be more likely to trust them. This is particularly concerning for businesses that regularly exchange sensitive information, such as law firms, accountants, insurance providers and other professional services organisations.
A compromised account could potentially affect client relationships as well as the security of the business itself.
Would You Recognise the Warning Signs?
Business email compromise isn’t always immediately obvious. An attacker may attempt to avoid drawing attention to their activity, particularly if they’re using the account to gather information.
However, there are several warning signs worth investigating:
- Unfamiliar login notifications: attempts to access an account from an unexpected device or location.
- Unexpected password resets: notifications about password changes you haven’t requested.
- Emails you didn’t send: unusual messages appearing in sent folders or being reported by colleagues.
- Changes to mailbox rules: unfamiliar forwarding rules or settings that automatically move or delete messages.
- Unexpected MFA requests: prompts to approve a login when you aren’t attempting to sign in.
- Unusual requests from trusted contacts: particularly changes to payment details or urgent requests for confidential information.
Not every unusual notification means an account has been compromised, but suspicious activity should be investigated rather than ignored.
How Can Small Businesses Reduce the Risk?
Protecting your business email doesn’t necessarily require complicated technology. A combination of technical security measures, sensible business processes and employee awareness can help reduce the likelihood and impact of email compromise.
Start with these practical steps:
1. Enable multi-factor authentication
MFA adds another layer of protection by requiring additional verification when someone attempts to access an account. Phishing-resistant MFA methods provide particularly strong protection where available.
2. Use strong, unique passwords
Avoid reusing passwords across different accounts. A reputable password manager can help employees generate and securely store unique credentials.
3. Verify payment changes independently
Make it standard practice to confirm changes to bank details through an established, trusted contact method. Don’t rely solely on the email requesting the change.
4. Monitor account activity
Appropriate monitoring and security alerts can help identify suspicious logins, unusual mailbox activity and other potential warning signs.
5. Keep employees informed
Help employees understand how business email compromise works, what suspicious requests might look like and how to report concerns.
6. Review account permissions
Make sure employees have access to the systems and information they need without unnecessary privileges. Remove access promptly when it’s no longer required.
Together, these measures can make it harder for criminals to compromise accounts and exploit the information they contain.
What Should You Do If You Suspect an Email Account Has Been Compromised?
If you notice suspicious activity, acting quickly is important. Report the issue immediately to your IT provider or whoever is responsible for cybersecurity within your organisation. They can help investigate the activity, secure the affected account, review active sessions and mailbox settings, and assess whether any information or other accounts may have been affected.
If fraudulent payments have been made, contact your bank’s fraud team immediately. Depending on the circumstances, there may also be data protection reporting requirements or a need to inform affected customers and suppliers.
Having a clear incident response process in place before something happens can make these situations much easier to manage.
Protecting Your Email Means Protecting Your Business
Your email account is more than a communication tool. It’s connected to your customers, suppliers, financial transactions and potentially many of the other systems your business relies on. That makes it an attractive target for cyber criminals.
The important thing is recognising that email security isn’t just about spotting suspicious messages. It’s also about protecting accounts, controlling access, monitoring unusual activity and making sure business processes aren’t easily exploited.
A genuine email address doesn’t always mean a genuine request.
By combining strong account security with appropriate verification procedures and employee awareness, small businesses can take meaningful steps towards reducing their exposure to business email compromise.
How Secure Are Your Business Email Accounts?
If you’re unsure whether your organisation has the right protections in place, now is a good time to review them.
At Ashdown Solutions, we help businesses understand their cybersecurity risks and identify practical ways to strengthen their security.
Whether you’re concerned about account protection, email security or your wider cybersecurity requirements, our team can help you understand where improvements may be needed.
Don’t wait until a compromised email account becomes a costly problem.
Speak to Ashdown Solutions about protecting your business, your information and the relationships you’ve worked hard to build.