After responding to a business email compromise at OYA, a 50-user financial services firm, we hardened Microsoft 365, identity and the checks around payment changes. The work targets the point where a convincing email could turn into a fraudulent payment.
In a business where instructions move between many parties, a familiar name can carry a lot of authority
OYA works with advisers, brokers, custodians, lawyers, suppliers and settlement agents, often around high-value, time-sensitive transactions. An apparently routine request can be acted on quickly in that setting.
Following our response to the incident, we reviewed the path from the sender and mailbox through to the decision to change payment details, and connected Microsoft 365 security with the checks applied when money is about to move.
Response to the BEC event, followed by security hardening
Email authentication, sender checks and anti-impersonation
MFA, Conditional Access and visibility of account misuse
High-risk payment changes checked beyond the email
A fraudulent request can reach a payment decision through an impersonated sender or a compromised account. We placed controls along each route and at the point where they meet.
Spoofed or lookalike executive and supplier requests
Makes fraudulent executive and supplier requests harder to pass off as legitimate
A legitimate mailbox used to send or support a request
Reduces the chance of account misuse and helps us recognise it earlier
High-risk changes are checked outside the message before they can proceed
The operating rule High-risk payment changes require verification beyond email.
We strengthened email authentication and sender controls to reduce exposure to spoofed and lookalike senders. The review looked at how a message could appear to come from a trusted organisation or contact, and the inbound checks used to assess it.
Sender controls were set alongside anti-impersonation settings and the kinds of requests OYA regularly receives, so fraudulent messages are caught before they become part of normal correspondence.
We tuned anti-impersonation protection around the executive and supplier identities attackers try to imitate, with attention to settlement updates, supplier requests and changes to payment details.
These are the messages most likely to be acted on because they resemble legitimate business. We focused the controls there while keeping ordinary payment instructions and documents flowing.
We hardened identity controls across Microsoft 365, including MFA and Conditional Access, to reduce the opportunity for an attacker to use an OYA account to send or support a convincing request.
Handling identity in the same engagement as email security and payment verification linked account access with the business actions a compromised account could be used to influence.
We improved visibility of suspicious mailbox behaviour and the activity attackers rely on after gaining access, adding attention to how an account behaves once in use.
This supports earlier detection of misuse and faster containment, with activity reviewed in the context of the financial communications those accounts handle.
We strengthened the payment-verification process so a high-risk payment-change request cannot be actioned from email alone. The requirement applies at the point where an instruction could alter where money is sent.
A convincing executive or supplier-style message still needs verification outside the message before a high-risk change goes ahead. The security work ends in a concrete operating rule for payment handling.
A stronger defence around the decision to release funds
OYA gained stronger protection against impersonation and account compromise, better visibility of mailbox misuse and a defined verification requirement for high-risk payment changes. The response to a real incident was carried through into changes across Microsoft 365 and payment handling.
Sender and identity protection make a fraudulent request harder to establish, while payment verification covers the moment that request could become a financial loss.
We review Microsoft 365, identity and payment-verification procedures together, then carry the improvements through into your systems and working practices.
Prefer email? contact@inlightit.com.au