An illustrative construction-firm scenario
A supplier asks to change bank details before Friday
A construction office receives an email that appears to come from a known supplier. It asks for the next progress payment to go to a new account and pressures the team to pay before the weekend. This scenario shows how we combine Microsoft 365 security, payment verification and staff training so a convincing message does not become a payment. It is not a claim about a named client or a recovered amount.
Why the message looks credible
The attacker uses the project relationship, not just a fake logo.
A supplier mailbox may be compromised, a lookalike domain may be registered, or a real conversation may be forwarded with the bank details changed. The message can mention the correct project, invoice and contacts while asking for one exception to the normal process.
The safe response is not to inspect the logo more carefully or reply to the same email. Stop, use the supplier’s known contact route, and require independent verification and approval before changing the instruction.
- New bank details or payment method
- Pressure to skip the normal call-back
- A changed reply-to address or domain
- A request for secrecy or unusual urgency
Controls that make the request harder to act on
No single filter or employee has to catch every attempt.
| Layer | What we configure or practice | Purpose |
|---|---|---|
| Identity | MFA, conditional access, least privilege and rapid account disablement | Make a stolen password less useful and contain a compromised account |
| Email authentication | SPF, DKIM and DMARC review, impersonation and lookalike-domain checks | Make supplier and internal impersonation more difficult |
| Mailbox and links | Suspicious forwarding rules, phishing and attachment controls, link review and report handling | Catch many malicious messages before or after delivery |
| Payment process | Independent call-back on a known number, two-person approval and a written supplier change record | Do not let the emailed request approve itself |
| Awareness and response | Role-based drills for office, project and finance staff, with clear escalation and bank contact | Make a suspicious request easy to stop and report |
The safe response
Technology supports the process; it cannot replace it.
If money has already moved, call the bank’s fraud line immediately, then contact us. Do not wait for a training session or a normal discovery call. Read our business email compromise guidance or the phishing-protection client story.
Test the process before a supplier request tests it for you
Review your email, identity and payment-change process with us. We will identify the gaps and give you a practical remediation plan.
Book a free assessment