Cybersecurity
The first 24 hours of a cyber incident: what to do, and what not to
Decisions made in the first hours of an incident decide how much is lost, how long recovery takes and whether you can later explain what happened.
Cybersecurity
Payment instruction fraud in trade: how it works and how to stop it
A supplier's email asks you to send the next payment to a new account. The message is genuine-looking, the timing is right, and the money is gone within hours.
Business email compromise is one of the most costly forms of cybercrime, and trading companies are attractive targets. Payments are large, counterparties are in several countries, and changes to bank details are a normal part of business. Attackers do not need advanced tools, only patience.
How a typical attack runs
- the attacker gains access to a mailbox at your company or at a supplier, often through a fake login page;
- they read correspondence quietly for weeks, learning who approves payments and when invoices are due;
- they register a domain that looks almost identical to the supplier's, or send from the compromised mailbox itself;
- just before a payment is due, a message arrives with updated bank details, often with a reason that sounds plausible, such as an audit or a change of bank.
Controls that work
- Call-back verification: confirm any change of bank details by phone, using a number already on file, never one from the email.
- Dual approval: a second person approves new or changed beneficiaries and large payments.
- A cooling-off period for payments to newly changed accounts.
- Multi-factor authentication on all email accounts, with alerts for new forwarding rules and logins from unusual locations.
- Email authentication: publish SPF and DKIM records and move your DMARC policy to reject, so others cannot easily send as your domain.
- Lookalike domain monitoring, so that registrations similar to your name or your key suppliers' names are spotted early.
If it happens
Call your bank immediately and ask for a recall; the first hours matter most. Report to the police, preserve the emails with their full headers, and check the mailboxes involved for forwarding rules and other signs of access. Tell the counterparty, since their systems may be the source.
Our threat intelligence and governance teams help trading and financial companies put these controls in place, monitor for lookalike domains, and investigate when a payment has already gone.
