A client calls me. They wired $47,000 to a vendor last week. The vendor never got it. The money is gone.
It didn't happen because of a sophisticated hacker. It happened because someone clicked an email that looked exactly like one from their actual vendor, entered credentials on a fake login page, and gave an attacker silent access to their inbox for three weeks.
I've had four calls like this already in 2026. Four separate businesses. Four wire transfers gone. Each one traced back to a Microsoft 365 account takeover — and in every case, the attacker used the compromised email to socially engineer the bank, impersonating the business owner to push the transfer through or reverse fraud holds.
This is what financial cybercrime looks like right now — and it's hitting small businesses harder than most people realize.
The Numbers Are Not Small
The FBI 2025 Internet Crime Report recorded $20.9 billion in cybercrime losses — a 26% year-over-year increase. Business Email Compromise (BEC) generated $3.047 billion in losses across 24,768 incidents, averaging $123,000 per case. 86% of those losses moved via wire transfer or ACH. Phishing losses nearly tripled year-over-year.
$20.9B
Total cybercrime losses (2025)
$123K
Average BEC loss per case
70%
Weekly BEC attempt probability for SMBs
Large corporations have dedicated security teams. Most small businesses have email and good intentions — which is exactly why they're the primary target.
Understanding the Three-Part Attack Chain
Part 1
Phishing — The Entry Point
In 2025, 82.6% of phishing emails involved AI-generated content — a 53.5% year-over-year increase. These are not broken-English scam emails. Spear phishing attackers know your vendor names, your payment approver, and your invoicing cadence. The goal is usually to steal email credentials, which opens Part 2.
Part 2
Command-and-Control (C2) — The Silent Presence
Once credentials are stolen, attackers deploy a C2 implant: malware that silently runs on an infected device and phones home to an attacker-controlled server. From there they can monitor email in real time, spread to servers and accounting systems, harvest credentials, deploy ransomware, and remain dormant for weeks or months. Modern C2 implants hide their traffic inside Teams, Slack, Google Drive, and AWS — so to your firewall, it looks like normal business activity.
Part 3
Wire Fraud and BEC — The Payoff
Vendor impersonation: An email says a vendor bank account changed. Three weeks later your real vendor calls asking why they haven't been paid.
CEO impersonation: Accounting gets an urgent wire request from the owner — quickly and confidentially.
Invoice fraud: A fraudulent invoice with real vendor details but attacker-controlled routing arrives in accounts payable.
Payroll diversion: An employee submits a direct deposit change before payday to an attacker-controlled account.
By the time the fraud is discovered, the money has moved through multiple accounts and is largely unrecoverable.
What We Do When We Walk Into a Compromised Business
When we get one of these calls, the first thing we do is secure the Microsoft 365 environment — lock down active sessions, reset credentials, enable MFA, and audit inbox rules for silent forwarding. In every one of the four cases we've handled this year, the attacker had created a forwarding rule inside the mailbox so they could keep monitoring communications even after the password was changed.
After M365 is stabilized, we tighten the email system — configuring DMARC, DKIM, and SPF so the domain can't be impersonated, and reviewing mail flow rules for anything suspicious. Then we recommend a business-grade firewall with DNS filtering and threat intelligence feeds to catch C2 beaconing traffic that a basic router would never flag.
That sequence — M365 hardening, then email authentication, then network-layer controls — addresses the most common entry and persistence points in order of urgency.
Why Small Businesses Are Especially Vulnerable
A few specific vulnerabilities we see repeatedly:
No out-of-band verification. A phone call to a known number would catch most payment redirection attacks. Most businesses don't have a policy requiring it.
Single-factor authentication on email. A stolen password is all an attacker needs. MFA is the single most effective, lowest-cost control available.
No EDR. Traditional antivirus does not catch modern C2 implants. Without behavioral monitoring, a C2 implant can live on your network for months.
Missing DMARC/DKIM/SPF. These make it significantly harder for attackers to impersonate your domain. Most small businesses haven't configured them.
Overloaded staff. In a 10-person company, the AP person is doing three other jobs. Attackers count on that.
What a Reasonable Defense Looks Like
We're not going to tell you that you need a $200,000 security operations center. But these controls meaningfully reduce your exposure:
Enable MFA on everything that touches money or email. M365, banking portals, QuickBooks, your VPN. Highest impact, lowest cost.
Implement a call-back policy for payment changes. Any request to change banking info requires a phone call to a known, pre-existing number. Put it in writing.
Deploy EDR on all endpoints and servers. Behavioral detection catches lateral movement and C2 traffic that antivirus misses.
Configure DMARC/DKIM/SPF. We can set these up in your DNS to make domain impersonation dramatically harder.
Train employees regularly. Phishing simulations and awareness training measurably reduce click rates.
Monitor for suspicious logins. Alerts for logins from unusual locations can catch a compromised account before the attacker acts.
If Something Sounds Familiar
If any of these attack patterns ring a bell — a vendor that recently asked to update banking info, an urgent wire request from leadership, a suspicious login you dismissed — take it seriously today.
We're not writing this to sell you something. We're writing it because we've had the conversations that happen after the wire transfer is gone, and they're not conversations anyone wants to have.
Want to know where your gaps are?
We can usually identify the most critical vulnerabilities in a single conversation — no pressure, no pitch.
Schedule a Free Security ReviewSources: FBI IC3 2025 Annual Report | SpiderLabs BEC Trends 2025 | APWG Phishing Trends 2025 | Huntress 2025 SMB Threat Report