Business email hacked? What to do (Australia)

What is business email compromise (BEC)?

Business email compromise (BEC) is a scam in which cyber criminals take over or impersonate a business email account to trick staff, clients or suppliers into sending money or divulging sensitive information. BEC attacks come in two main forms:

• Email account compromise. Attackers gain access to a real email account, usually with stolen login credentials, and send fraudulent emails from it. Because the message comes from a genuine account, it's very convincing.
• Spoofing. Attackers use spoofed email addresses or domain spoofing, such as a lookalike email domain one letter different, to pretend to be someone you trust.

Common BEC scams

• Fake invoices and payment changes. BEC scammers send fake invoices or ask to change bank details, so future payments go to their bank account. This is the most common BEC exploit against Australian businesses.
• CEO fraud. A scammer pretends to be the company's CEO or a company executive and asks the finance department for an urgent wire transfer or payment.
• Data theft. Attackers target employees in HR or payroll to get employee data, sensitive data or credit card details, which can lead to identity theft.
• Attorney or adviser impersonation. Threat actors pose as lawyers, accountants or conveyancers and pressure victims with urgent, confidential requests.

BEC schemes evolve constantly. Attackers study your email systems, wait for a real invoice, then send payment details at just the right moment.

Signs your email account has been compromised

• Clients or suppliers get emails you didn't send, often with new bank account details or a link to view a document.
• Sent items, deleted items or inbox rules you don't recognise.
• Emails forwarded to an outside address.
• Sign-in alerts from unfamiliar locations, or MFA prompts you didn't start.
• You're suddenly locked out of the account.

What to do in the first hour

1. Call your bank immediately if money may have moved. Speed matters for recovering funds. Ask them to contact the receiving bank about the fraudulent account.
2. Reset the email password from a device you know is clean.
3. Sign the account out of every session. In Microsoft 365, revoke sessions so the attacker's access ends, not just yours. Your email provider can help if you're locked out.
4. Check multi-factor authentication methods. Remove any phone or app you don't recognise, and turn MFA on if it wasn't.
5. Remove inbox rules and forwarding set by the attacker. These hide replies and suspicious activity from you.
6. Remove connected apps granted access to the mailbox, in case attackers used them to install malware or keep access.

What to do in the first day

7. Report it. Report to police and ASD through ReportCyber at cyber.gov.au, or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371), which runs 24/7.
8. Notify contacts who were emailed from the compromised account, by phone or from a different account, never by replying to the fraudulent thread.
9. Work out what the attacker saw. Check which emails, attachments and confidential information were accessed. Your IT provider can pull the sign-in and mailbox audit logs.
10. Secure other accounts. Change passwords on other accounts that used the same password, and on any account whose reset emails go to the hacked mailbox. Multiple accounts may be affected.

Within 30 days: your legal obligations

If your business is covered by the Privacy Act and personal information was accessed, you must assess whether it's an eligible data breach likely to cause serious harm. Covered businesses include most with turnover over $3 million and all health service providers. The Office of the Australian Information Commissioner (OAIC) expects the assessment within 30 days, and eligible breaches must be notified to the OAIC and affected individuals. Tax practitioners should also contact the ATO's Client Identity Support Centre on 1800 467 033.

How to prevent future attacks

• Enforce multi-factor authentication for every account, with phishing-resistant methods for admins.
• Block legacy sign-in that bypasses MFA.
• Protect your email domain with SPF, DKIM and DMARC so cyber criminals can't easily spoof it.
• Alert on suspicious activity: new forwarding rules and sign-ins from unusual places.
• Verify payment changes by phone using a number you already have, never one in the email.
• Security awareness training. Employee training helps staff spot suspicious emails, unusual requests and urgency tactics. Real world examples of BEC attempts make it stick.

Staff who know what a BEC attempt looks like are far less likely to fall victim, and far more likely to report it early, before significant financial losses.

When to call a professional

Call your IT provider straight away if the account had admin rights, if more than one account is affected, or if you're unsure the attacker is out. Static Computers clients should call 1300 366 638. For help protecting against cyber attacks generally, see cyber security services.