Security Awareness Briefing  //  Eriu Technology  //  Defensive Use Only

WIRE
& DECEIT

The invoice was real. The bank details weren't.

How business email compromise quietly reroutes your money — and the one phone call that stops it.

01 / What it is

Business email compromise (BEC) is fraud by impersonation. Someone gets into — or convincingly fakes — a real email thread, waits for a genuine invoice, and sends a polite follow-up: our bank details have changed. Everything else is authentic, which is exactly why it works.

02 / How it works
1
The attacker watches a real email thread — a hacked mailbox, or a look-alike address.
2
They wait for a genuine invoice, or a payment that's due.
3
They send a follow-up asking you to update the bank details.
4
You pay the real amount, for real work — into their account.

→ The money's gone the moment it lands; by the time the real supplier chases it, it's been moved on three times.

Where it strikes

The con thrives wherever money moves on trust and routine:

Supplier invoices'Our account has changed' on a real bill.
The CEO 'ask''Can you do an urgent transfer, quietly?'
Property & legalDeposits and completion funds, redirected.
PayrollAn employee's salary account 'updated'.
!
Verify on a number you already hadAny change of bank details, any urgent transfer — confirm it by ringing the supplier or colleague on a number you already have, never the one in the email. Thirty seconds on the phone beats a five-figure wire you'll never see again.
03 / Why it's dangerous
  • Nothing looks wrong. The email, the invoice and the amount are all genuine.
  • It beats spam filters. There's no dodgy link or attachment to catch.
  • Speed is the weapon. 'Urgent' and 'confidential' exist to stop you checking.
  • The money moves fast — once wired, it's rarely recoverable.
04 / How you stop it
  • Call to confirm every bank-detail change — on a known number, not the one on the email.
  • Make a two-person rule for new payees and transfers over a set amount.
  • Be wary of 'urgent and quiet' — that combination is the tell.
  • Turn on MFA for email, so mailboxes can't be silently read.
  • Check the sender's address character by character, not just the display name.
The bill was real · The account was not
An Eriu Technology security briefing  ·  Awareness & defence only