Finding out that someone else has been inside your business email is unsettling. Customers may have received fake invoices in your name, or your own team may have paid one. The steps you take in the first hour make a real difference to how much money is lost and how much you can find out later.
This guide is for owners, managers and IT staff in Australia and New Zealand. It covers what to do straight away, what not to do, and when to bring in help.
If money has moved in the last few hours, stop reading and call your bank now. Ask them to recall the payment. Then come back to this guide.
Signs your business email has been compromised
Email compromise is often noticed by someone outside the business first. Common signs include:
- A customer or supplier asks about a change of bank details you never sent
- People reply to emails you don’t remember writing
- Emails go missing, or replies arrive that you never saw the original for
- You get sign-in alerts from unfamiliar locations or devices
- Staff see multi-factor prompts they didn’t trigger
- Contacts report odd messages, links or attachments from your address
Any one of these is reason enough to treat the account as compromised until you know otherwise. Our Is this BEC? self-check takes a minute and can help you decide.
What to do in the first hour
- Protect payments. If any payment may have gone to the wrong account, call your bank immediately and ask for a recall. Warn your accounts team not to pay any invoice with changed bank details until it has been confirmed by phone on a number you already had.
- Warn the people at risk. Contact affected customers and suppliers on a known phone number, not by replying to the suspicious thread. Tell them not to act on recent payment requests from your address until you confirm them.
- Keep the evidence. Don’t delete suspicious emails, rules or accounts, even if you want them gone. They show what the attacker did and when.
- Change the password and check sign-in protection. Change the affected account’s password from a device you trust, and make sure multi-factor authentication is switched on.
- Tell your insurer. If you have cyber insurance, follow your insurer’s incident process early. Many policies expect to be told quickly.
- Get specialist help. Email response@authene.com.au. A responder replies within 15 minutes, 24/7/365, and will tell you what to do next.
Why changing the password isn’t enough
It’s natural to change the password and hope that’s the end of it. Unfortunately, attackers who get into a mailbox often set things up so they keep receiving mail or can get back in after a password change. Others have already read months of conversations and know exactly who to target next.
A proper response removes every way back in and establishes what the attacker read, sent and changed while they had access. That answer matters for your customers, your insurer and, if personal information is involved, your legal counsel.
What not to do
- Don’t reply to the attacker or the suspicious thread, even to say you know.
- Don’t wipe or rebuild the account or computer before the evidence is preserved.
- Don’t rely on email to warn people. The attacker may still be reading it.
- Don’t assume it’s only one account. Attackers often use one compromised mailbox to target colleagues and clients.
Who to report it to
Reporting is free and helps authorities warn others. For payment fraud, a fast report can help with recovery.
- Australia: report to ReportCyber (the Australian Signals Directorate) and to Scamwatch.
- New Zealand: report to the National Cyber Security Centre.
- Identity support: IDCARE helps Australians and New Zealanders whose details have been misused.
If personal information may have been accessed, there may be notification obligations under Australia’s Notifiable Data Breaches scheme or New Zealand’s Privacy Act 2020. Whether they apply is a question for your legal counsel. An investigation gives them the facts to decide.
When to bring in incident response
Bring in specialist help if money has moved, if you can’t tell how the attacker got in, if more than one account is involved, if customer or personal information may have been seen, or if you need a clear account of what happened for your insurer or lawyers.
Authene responds to business email compromise across Australia and New Zealand. We work alongside your IT provider, find out what the attacker saw and did, and give you a one-page summary first, with the evidence behind it. Download our free BEC first-hour checklist to keep on file.
Sources
- Australian Signals Directorate, Report and recover
- Scamwatch, Business email compromise scams
- National Cyber Security Centre (NZ), Report a cyber security issue