Wire Fraud Now Comes From Real Inboxes

Picture a controller at a mid-sized Los Angeles firm. She opens a message from a vendor she has paid every month for four years. Same thread. Identical signature block. Correct invoice number, correct amount, correct purchase order. The note says the vendor's bank was acquired and remittance details change with this cycle. Nothing is attached, and there is no link to inspect. The sending domain belongs to the vendor, because the message was composed and sent from the vendor's own mailbox.

There is nothing in that message for a filter to catch. The email is authentic. Its instruction is not.

This is where business email compromise sits in 2026, and it explains why organizations that have spent seriously on email security still send money they never recover. The product most of them bought was designed for a threat that has largely moved on.

The attacker is not spoofing you — they are signed in

The older model of BEC was impersonation: a lookalike domain, a display-name trick, a free webmail account posing as the CEO. Those attempts still arrive, and current filtering handles most of them.

The expensive version works differently. An attacker holds a valid session in a real mailbox — a supplier's, a law firm's, sometimes your own. One common path is a reverse-proxy phishing page that passes the login through to the genuine service and captures the resulting session token; the user satisfies multi-factor authentication in real time, and the token is replayed. Another is an OAuth consent prompt for an app the user believes is a document viewer, granting persistent mail access without a password ever changing hands.

Both paths produce the same result: a legitimate identity doing illegitimate things. Nothing is escalated. No malware runs.

The intruder then reads. For days, sometimes weeks, learning the payment cadence, who approves what, how colleagues write to each other, and which invoices are already expected. This is analysis rather than speculation: that patience is precisely what defeats awareness training, because by the time the request arrives it is indistinguishable from the ordinary.

That is the distinction executives most often miss. Business email compromise is an identity compromise that happens to express itself in email. Treating it as a mail-hygiene problem funds the wrong control.

A callback is a control only if you choose the number

For a decade the standard advice on changed banking details was to call the vendor and confirm. That advice still holds. What no longer holds is the assumption underneath it.

Voice synthesis has moved from specialist tooling into ordinary consumer software. Executives are the most exposed, because their voices are public — earnings calls, conference panels, podcast appearances, webinar recordings, the company's own marketing video. The raw material is sitting on your website.

So state the point precisely: a phone call remains useful, but the voice is no longer the evidence. What makes a callback a control is the number dialed. A number supplied in the request that prompted the call verifies nothing at all. A number drawn from your vendor master record, recorded before the request existed, is a genuine control, because an attacker would have to compromise the phone line as well as the mailbox.

A prediction, offered as prediction: voice confirmation on its own will come to be treated by cyber insurers the way unencrypted laptops were eventually treated — an acknowledged gap rather than a defense.

Your Microsoft 365 tenant records the takeover first

When a mailbox is taken over, evidence appears in the tenant before anyone notices an unusual invoice. The signals are unglamorous and specific:

• A new inbox rule routing messages containing "invoice," "wire," or "ACH" into a rarely-opened folder, often named with a single character or a period
• External forwarding switched on for one account
• A sign-in from an unexpected location minutes after a legitimate one from Los Angeles
• A new third-party application grant with mail-read scope, consented to by a standard user
• Mailbox activity in the middle of the night that lines up neatly with business hours somewhere else

These events are logged by default in Microsoft 365. Reading them on a schedule, and acting the same day when one appears, is a separate commitment that many organizations never make. Our view, stated as opinion: the distance between detection being possible and detection being performed is where the loss actually occurs, and no purchase closes it.

One addition specific to 2026. AI assistants inside the tenant compress reconnaissance. An intruder holding a valid session no longer needs to scroll years of mail to find the finance thread; natural-language search across everything that account can reach surfaces it immediately. That is an argument for governing assistant access by identity and data boundary, not an argument against the technology. An assistant respects the permissions it is given. Permissions granted broadly to a compromised account are exactly that broad for whoever is holding the session.

Move payment authority out of the inbox

The structural fix is not closer scrutiny of email. It is removing the decision from the channel the attacker controls.

Changes to payment instructions should be a record change in a system of record, under dual control, with a mandatory hold before the first payment on new details. Approval authority should follow role, not whoever sent the message. Under that model the content of any email becomes irrelevant — a request is only a request, and the control sits elsewhere.

Three technical decisions carry disproportionate weight for a 20-to-500-seat business:

• Phishing-resistant authentication for finance, executives and administrators. Passkeys and certificate-based sign-in defeat the proxy-and-replay pattern that one-time codes do not.
• Conditional Access with device compliance enforced, so a stolen token is worth far less when presented from an unmanaged machine, paired with blocking legacy authentication protocols outright.
• Restricting user consent for third-party applications, which quietly closes one of the most common persistence routes.

None of this is exotic. Much of it is already licensed in the Microsoft tenants these companies pay for every month and simply never configured — a recurring finding in IT security work, and the clearest argument for treating configuration as a standing discipline rather than a project with an end date.

The seam between finance and IT is a leadership problem

Finance owns the authority model. IT owns the identity model. Business email compromise lives in the seam between them, and seams are not closed by either department acting alone. They are closed by the executive who can tell both departments what the rule is and then fund it.

Speed decides the rest. A suspicious sign-in has value only if a competent person acts on it while the payment is still unsent, which is why response time belongs in the security conversation and not only the convenience one. Pro Link Systems runs a 24/7 in-house, US-based help desk with an average ticket first-response time of 15 minutes, answered live rather than queued — a standard held while serving Los Angeles businesses from Woodland Hills since 1999.

If payment authority, identity controls and tenant monitoring have never been examined together in your environment, our managed IT services team will walk through them with you.