Business fraud: the five patterns that drain company accounts
Most business-account fraud is not sophisticated hacking. It is five well-known social-engineering patterns that keep working because people are not trained on them.
The glamorous image of corporate hacking — breached databases, zero-day exploits — accounts for a small fraction of actual losses from business accounts. The majority of losses come from five social-engineering patterns, each of which has been well-known for years and keeps working because training lapses. Teach these to your team.
1. CEO wire fraud (BEC)
Fraudster compromises or spoofs the CEO's email, asks accounts payable to urgently wire funds to a new supplier, often "while I'm travelling and can't sign off in person". Volume: €1-€5M losses per incident at mid-sized companies. Defence: require any wire above a threshold (e.g., €10,000) to be verbally confirmed by the sender using a known phone number — not the number in the email.
2. Invoice redirect fraud
Fraudster compromises a real supplier's email, sends an updated invoice with new "bank details for payment". You pay to the fraudster's account; the supplier never sees it. Defence: Confirmation of Payee (the recipient name must match the supplier). Verbal verification for any supplier bank-detail change (not email reply). Supplier update policies require two-person approval.
3. Payroll diversion
Fraudster compromises an employee's HR portal credentials and changes the bank account on file. Next payroll run deposits salary to the fraudster. Defence: HR portal must send a confirmation email + delay (24-48 hours) when bank details change. MFA on HR portal access.
4. Fake vendor onboarding
Fraudster sets up a plausible-looking vendor website and submits an "invoice" for a service your business plausibly uses (SEO, legal, IT support). Low enough amount to pass unnoticed in approval queues. Defence: vendor onboarding should require a human sign-off and a verification call. Expense categorisation should flag "unknown vendor" first-time invoices for review.
5. Business-email fraud via "URL compromise"
Fraudster buys a domain one letter off from a key counterparty (nedsom-com vs nedsom.com, with a missing dot). Sends emails from "noreply@nedsom-com" that look legitimate. Can be used for any of the above patterns. Defence: domain-based email authentication (DMARC/DKIM) on your own domain, and employee training to inspect sender domain carefully for critical actions.
Operational controls that cut all five
Dual-approval for any wire above a threshold. 24-hour cool-off before new vendor payments. Verbal verification on bank-detail changes. Spending-category alerts on unusual activity. Quarterly simulated phishing with retraining for anyone who clicks. These five controls, uniformly applied, eliminate 90%+ of successful attacks.