Incident response · Business email compromise
Email fraud, handled fast.
Business email compromise is when an attacker gets into, or convincingly imitates, a mailbox and uses it to redirect payments or steal information. It’s one of the most costly cyber incidents Australian businesses face, and speed matters: the sooner you act, the better the chance of recovering funds.
Response
15 minutes, 24/7/365
Common signs
Changed bank details and unexpected replies
Our focus
Stopping the fraud and finding the scope
You get
A clear account of what was accessed
Why speed matters
The money moves in hours.
Misdirected payments are often moved on quickly. At the same time, the attacker may still have access, reading conversations and planning the next request. Responding well means acting on both fronts at once: the money and the mailbox.
Signs you may see
How it usually shows up.
- A supplier or customer says they paid you, but the money never arrived
- A request to change bank details, often with some urgency
- Replies to emails you never sent
- Mailbox settings or rules nobody remembers changing
- Sign-in alerts from unfamiliar locations
If it’s happening now
What to do first.
- If money was sent, call your bank now and ask for a recall
- Contact the supplier or customer on a phone number you already hold
- Don’t reply to the suspicious email thread
- Don’t delete emails or change settings yet. They’re evidence
- Email response@authene.com.au. A responder replies within 15 minutes, 24/7/365
How we help
What a response covers.
Every incident is different. These are the areas we work through with you.
Contain
Remove the attacker’s access and stop further fraudulent requests.
Scope
Establish which mailboxes and accounts were affected, and for how long.
What was exposed
Work out what information the attacker could see or take.
Facts for the money trail
Give your bank, insurer and lawyers the facts they need, quickly.
Clear reporting
A one-page summary first, with the evidence behind it.
Built for this
Our own software, BECRIP, was built for Microsoft 365 email fraud investigations.
How a response runs
A calm, fixed sequence.
Triage
A responder takes the facts and tells you what to do in the next hour.
Contain
Attacker access is removed and evidence is preserved.
Investigate
We establish how they got in and what they did.
Report
Findings for leadership, your insurer and your lawyers.
Harden
We help close the gaps that allowed it.
What you get
Clear outputs, not a slide deck.
- A timeline of the attacker’s activity
- A clear account of what was accessed
- Findings your insurer and lawyers can rely on
- Prioritised fixes to prevent a repeat
Who we work alongside
Everyone in the room.
- Your leadership and finance teams
- Your bank
- Your IT provider or MSP
- Your cyber insurer and lawyers
Other incidents
And the ones that don’t fit a box.
If you’re not sure what you’re looking at, that’s the time to get in touch. Working it out is our job.
Questions
Common questions.
What is business email compromise?
Business email compromise (BEC) is when an attacker gets into, or convincingly imitates, a business mailbox and uses it to trick people. The most common version changes the bank details on a real invoice, so a customer or your own team pays the attacker instead of the supplier.
We paid a fake invoice. What should we do first?
Call your bank straight away and ask them to recall the payment. Speed matters, because misdirected funds are often moved on within hours. Then report it to ReportCyber (Australia) or the NCSC (New Zealand), don’t reply to the suspicious email thread, and email response@authene.com.au so a responder can help you work out how it happened. Our guide to what to do after paying a fake invoice covers the next steps.
How do I know if our email account has been hacked?
Common signs include customers asking about payment details you didn’t change, replies to emails you didn’t send, unexpected sign-in alerts, missing emails and contacts receiving odd messages from you. If you see any of these, treat it as a possible compromise until it’s ruled out. Our Is this BEC? self-check can help.
Is changing the password enough?
Usually not. Attackers who get into a mailbox often set things up so they keep access or keep seeing mail after a password change. A proper response removes every way back in and works out what they read or sent while they were there.
Can you tell us what the attacker saw?
In most cases we can establish what the attacker accessed and did, within the limits of what the platform recorded. That answer matters for your customers, your insurer and your legal counsel.
Can the money be recovered?
Sometimes. The best chance is a fast call to your bank and a report to the authorities. We can’t promise recovery, but we can give your bank, insurer and lawyers clear facts about what happened.
Official help and reporting
Where to report, and who else can help.
These services are free. Reporting helps authorities warn others and, for payment fraud, can help with recovery. Your legal counsel can tell you whether you have to notify anyone.
Business email compromise
Every hour counts.
If something is happening now, email us and a responder will reply within 15 minutes, 24/7/365. If you’re not sure it’s an incident yet, get in touch anyway.