3 September 2026LANTEK Computers
Most people picture an attack as something breaking. A screen full of warnings, files locked, an obvious moment when it started.
Business email compromise is not that. Nothing breaks. Somebody signs in to a mailbox using a password that works, reads quietly for a period, and then sends one message that looks exactly like all the others around it. The first anyone knows is usually a supplier asking why they have not been paid, or a client asking why their money went somewhere else.
It is worth understanding as a sequence, because each stage has a different control that interrupts it, and the cheap ones are near the beginning.
Stage one: a password that already works
The attacker does not need to break anything to get a password. In most cases they buy or find one that already exists.
The usual source is not your systems at all. It is another service that a member of staff signed up to with their work email address, which was later breached. If the same password was used in both places, it now works on your mailbox too. This is why what dark web monitoring finds is so often nothing to do with your own security.
The other route is a convincing sign-in page. Not a badly spelled one: a page that looks correct, arrives in a message about something plausible, and takes a password from somebody who was thinking about their morning rather than the address bar.
What stops it here. Multi-factor authentication, which makes the password insufficient on its own, and knowing which of your addresses are already circulating so those passwords get changed before anybody uses them.
Stage two: signing in, and looking unremarkable
With a working password the attacker signs in. Not with anything exotic: the normal way, from a normal browser.
This is the part that surprises people. There is nothing to detect in the traditional sense. No file to scan, no software installed, nothing for antivirus to find. A legitimate credential used by the wrong person looks, to most systems, like a person signing in.
What does give it away is context rather than content. The same account signing in from two countries an hour apart. A sign-in at three in the morning from an account that has never once been used outside working hours. An impossible journey between locations. None of that is visible unless something is watching for it, which is the actual argument for continuous monitoring: not that it blocks more, but that it notices sooner.
What stops it here. Conditional access rules that refuse sign-ins that make no sense, and alerting on the ones that are merely unusual.
Stage three: quietly arranging to keep the access
An attacker who has got in expects to be locked out eventually, so the next move is to make the access survive a password change.
The most common step is an inbox rule. Something that forwards a copy of everything, or of anything containing certain words, to an address outside the business. Sometimes a rule that moves particular messages into an obscure folder, so the real owner does not see the reply to a conversation that is being held on their behalf.
Alongside that: adding a recovery address or telephone number, so the account can be reset later, and sometimes granting another account access to the mailbox.
These are the fingerprints. They are the reason that changing the password is necessary but not sufficient, and the reason that checking for rules you did not create belongs in every response.
What stops it here. Alerting when a forwarding rule to an external address is created, which is a setting rather than a product, and forwarding to outside addresses being blocked by default.
Stage four: reading, and this is the part that costs money
Now the attacker does nothing at all for a while. Days, sometimes considerably longer.
What they are doing is learning your business. Who authorises payments and who queries them. How your invoices look. Which suppliers are mid contract and roughly when the next payment falls. How your finance staff write: whether they say hi or good morning, whether they sign off with their first name, how formal the tone is. Who is about to go on leave, because an absent person cannot be asked to confirm anything.
This patience is exactly why the eventual message is convincing. It is not a template. It refers to a real project, quotes a real amount, and arrives inside a real thread at a plausible moment.
What stops it here. Almost nothing technical, which is the point. This stage is why the value is in shortening how long the access goes unnoticed, rather than in expecting to catch the final message.
Stage five: the request
The message, when it comes, takes one of a few shapes.
A supplier’s banking details have changed, sent from the supplier’s genuinely compromised mailbox, so every check on the sender passes. A request from a director, timed for when that director is travelling and hard to reach, to make a payment quickly and discreetly. An invoice from a real supplier for a real amount, altered only in the account number. Or a message to a client, from your own compromised mailbox, giving new details for a payment they are already expecting.
In property and conveyancing this is at its most damaging, because the amounts are large, the timing is known to everybody, and the transfer is expected. That specific case is covered in the property transfer fraud that starts inside a real email thread.
What stops it here. One rule, applied without exception: banking details are never changed on the strength of an email. They are confirmed by telephone, on a number you already had on file before the request arrived, not a number in the message. It is unglamorous and it works, and the exception is always the one that costs.
Why this is harder to defend than ransomware
Ransomware announces itself. You know the day it happened and you know what to do about it.
This does not. There is no malicious file, the sign-in is legitimate, the message comes from a real address inside a real conversation, and the fraud completes as an ordinary payment made by a member of your staff who did their job as they understood it. Afterwards it is frequently unclear whose mailbox was actually compromised, yours or the supplier’s.
Which means the defence is not a product. It is a small number of controls at different stages, and none of them is expensive.
The five that matter, in order of value for effort
One. Multi-factor authentication on every mailbox, no exceptions for senior staff. The exception is always the account worth having.
Two. A telephone verification rule for banking changes. Written down, told to clients and suppliers so they expect it, and applied to the managing director as firmly as to anybody else.
Three. Alerting on forwarding rules and mailbox delegation. The cheapest early warning available.
Four. Somebody watching sign-in behaviour. The gap between access and discovery is where the cost accumulates.
Five. Tell staff how the request will actually look. Not that phishing exists. That it will come from a real address, inside a thread they recognise, about a payment they were expecting, at a moment when the person who could confirm it is unreachable. A simulation teaches that better than a slide does.
If you think it has already happened
Change the password and sign every session out, then check for rules and delegations before you conclude it is over, then freeze banking changes. That sequence and the rest of the first day is in what to do in the first 24 hours.
If you would rather find out whether any of your addresses and passwords are already circulating, that is what the free dark web scan answers. Thirty minutes, no obligation, and you keep the report either way.