Business email compromise and the changed-IBAN invoice: first hours and investigation

Illustration: an invoice with a changed IBAN and a diverted payment

Business email compromise (BEC) means a criminal slips into a real business conversation and asks for payment into an account they control. If you have already paid, call your bank at once to request a payment recall, keep the emails in their original form and delete nothing from the affected mailbox until it has been analysed.

Key points

  • BEC uses real conversations, real suppliers and plausible amounts, which is why it gets past routine checks.
  • The first hours matter: the bank can only attempt a recall or freeze if it is told quickly.
  • Usually one of the mailboxes involved, yours or the supplier’s, has been compromised; the investigation establishes which.
  • Under Romanian law the act may qualify as computer fraud (Criminal Code art. 249, 2 to 7 years’ imprisonment).
  • A verification call to a number you already know stops most attempts; video calls and AI-cloned voices make that control even more necessary.

How does a BEC fraud work?

The typical scenario has four stages:

  1. Access. The criminal obtains a mailbox password, usually through phishing, or registers a domain almost identical to a partner’s.
  2. Observation. They quietly read the correspondence for weeks: who approves payments, which suppliers matter, when invoices arrive, how people write.
  3. Interposition. At the right moment they reply inside the genuine thread: “We have changed banks, please use the new IBAN”, with an altered invoice attached.
  4. Concealment. They create rules that move replies into hidden folders or forward them, so the real participants never see the confirmations.

Common variants are the supplier invoice with new bank details, the “urgent and confidential” request from the CEO to accounting, and a request to change an employee’s salary account.

Why it is a direct financial loss

Unlike many incidents, BEC turns an email straight into lost money. The amount is usually large, because the criminal waits for a significant invoice. On top of the direct loss come:

  • the supplier relationship, since the supplier was not paid and may ask for payment again;
  • time spent by finance and management;
  • the cost of investigation and remediation;
  • the risk that the same compromised mailbox exposed other data.

IBM’s Cost of a Data Breach Report 2025 puts the global average cost of a breach at USD 4.44 million and the average breach lifecycle at 241 days from occurrence to containment. BEC is often the visible tip of a compromise that has been running for a long time.

What to do in the first hours after spotting the wrong payment

  1. Call your bank immediately, not just by email. Ask for a payment recall and a freeze at the beneficiary’s bank. Note the name of the person and the time.
  2. Alert the real supplier through a verified channel, a phone number you already know rather than the one in the email.
  3. Do not delete the fraudulent messages or forward them as plain text; keep them in the mailbox or export them in original format (.eml or .msg) with full headers.
  4. Change the passwords of the mailboxes involved from a clean device and enable multi-factor authentication, without wiping the logs.
  5. Check mailbox rules: forwarding to external addresses, rules that move or delete messages.
  6. Preserve sign-in logs from the email platform; some services keep them only for a limited period.
  7. Collect the payment documents: payment order, statement, original invoice and forged invoice.
  8. Decide with your lawyer whether to file a criminal complaint with the criminal investigation bodies.

What does the mailbox investigation show?

The technical investigation answers a few simple questions, with evidence.

Where was the breach: on our side or the supplier’s?

Full message headers show which servers a message passed through, which domain it came from and whether it passed SPF, DKIM and DMARC checks. A message sent from a look-alike domain points to impersonation, not necessarily a compromised mailbox. A message sent from the supplier’s real mailbox points to a compromise on their side.

Since when did the criminal have access?

Sign-in logs reveal connections from unusual countries, networks or devices, sessions that survived a password change, and third-party apps that were granted mailbox access.

What did they see and change?

Forwarding rules, read messages, downloaded attachments and edited documents show what information was exposed. This also matters for data protection duties if personal data was involved.

How was the fake invoice made?

Comparing the forged invoice’s metadata with the original shows what was changed, with which software and sometimes when. The beneficiary account, the domains and the criminals’ email addresses become indicators that can be correlated with other cases.

Legal qualification and jurisdiction in Romania

Computer fraud (Criminal Code art. 249) covers entering, altering or deleting computer data, restricting access or hindering the operation of a system for material gain, where damage results, punishable by 2 to 7 years’ imprisonment. Getting into someone else’s mailbox may also be illegal access to a computer system (art. 360), and the altered invoice may raise computer forgery (art. 325).

Under Law 508/2004, acts under art. 325 and art. 360-366 fall under DIICOT, the specialised prosecutor’s office, while computer fraud goes to DIICOT when committed for an organised criminal group. The exact legal qualification is for the prosecutor and the lawyers; the technical analysis gives them verifiable facts.

Controls that stop BEC

Control What it stops Implementation cost
Call-back to a known number for any bank detail change Changed-IBAN invoices, CEO fraud Very low, procedure only
Multi-factor authentication on every mailbox Access with a phished password Low
Alert on new external forwarding rules Hidden conversations Low
Strict SPF, DKIM and DMARC Spoofing of your own domain Low
Monitoring of look-alike domains Clone domains of your company Low to medium
Dual approval above a payment threshold Payments decided by one person under pressure Low
Training for the finance team All variants, including new ones Medium

Beware of cloned voices and faces

The call-back remains the most effective control, but it must be done properly: to a number already on file, not the one in the message, and with a control question. In January 2024 in Hong Kong, a finance employee at Arup made 15 transfers, about USD 25 million, after a video call in which the other participants were deepfakes of senior managers. BEC no longer stops at email.

How ProDefence can help

Our cybercrime investigation service covers exactly this kind of case: we take in what happened, preserve messages and logs before they are lost, analyse the mailboxes involved and reconstruct the attacker’s actions. Our role is technical: to establish what happened and document the evidence. You receive a technical report, evidence documented in a form usable in criminal proceedings, indicators of compromise (domains, addresses, accounts) and a remediation plan. The decision to involve the authorities stays with you.

For suspicious attachments, our malware and fraud analysis shows what a file does and what it could collect. When the case reaches your lawyer, ProCIS organises correspondence, payments and bank replies into a verifiable factual chronology (currently contracted in Romanian, via procis.ro). For prevention, our security audit and penetration testing checks authentication, domain configuration and mailbox rules, and our training prepares the finance team.

On the prevention side, the people who pay invoices are the direct target of BEC fraud. CysGame (in Romanian) offers free interactive quizzes and missions on phishing, useful as a short, recurring exercise for the finance team.

Frequently asked questions

Can I get back money paid to a fraudulent IBAN?

Sometimes, if the bank is told very quickly and the funds have not yet been withdrawn or moved on. There is no guarantee. Ask your bank for an immediate recall, alert the real supplier and keep every document for the criminal complaint and for discussions with the beneficiary’s bank.

Who is liable: us or the supplier?

It depends on where the compromise happened and what the contract says. The technical investigation establishes, from headers and logs, whether the fake message came from the supplier’s mailbox, a clone domain or your own mailbox. Interpreting those facts legally is a matter for the lawyers.

Should we delete the fraudulent messages?

No. Keep them in their original form with full headers, or export them as .eml or .msg files. Deleting them, forwarding them as text or “cleaning” the mailbox destroys exactly the information that shows the message route and when the compromise began.

How do I spot a fake bank detail change request?

Typical signs are urgency, a request for confidentiality, a new bank or country, small differences in the sender address and an invoice identical to previous ones. The safe rule: any change of account is confirmed by phone on a number you already know.

Does a BEC incident have to be reported to DNSC?

Essential and important entities under Romania’s GEO 155/2024 must notify DNSC of significant incidents: early warning within 24 hours, notification within 72 hours, final report within one month. If personal data was exposed, notifying the data protection authority within 72 hours may also be required.

How long does a mailbox investigation take?

It depends on the number of mailboxes, the period covered and the logs available. The urgent part, preserving messages and logs, happens in the first days, because some platforms retain logs only for a limited time.

Sources

Alexandru Angheluș, ProDefence. Cybersecurity specialist who has analysed many phishing and financial fraud campaigns targeting companies and users in Romania.

How to choose an NIS2 consultant in Romania: 12 questions and the red flagsIllustration: a checklist for choosing an NIS2 consultant, with red flags
Skip to content