A single convincing email. One click from a distracted staff member. $47,000 transferred to an offshore account before anyone noticed. This is not a hypothetical — it's a pattern that repeats across New Zealand every week.
In early 2023, a small Wellington accounting firm received an email that appeared to come from one of their long-standing suppliers. The email explained that the supplier had changed their banking details and asked that all future payments go to a new account. The email used the supplier's real name, real logo, and real contact information — scraped from the supplier's own website.
A senior administrator processed the next invoice payment to the new account. $47,000 left the firm's account and landed in a mule account in Eastern Europe. By the time the firm realised something was wrong — when the real supplier called asking about the overdue invoice — the money was gone. Recovery was partial and took eight months.
This Attack Has a Name: Business Email Compromise
What the Wellington firm experienced is called Business Email Compromise (BEC) — specifically the vendor impersonation variant. The attacker didn't need to hack anything. They studied the firm's public information, identified a supplier relationship, and sent a convincing email asking for a bank account change. No malware. No ransomware. Just a well-crafted deception.
CERT NZ recorded over $6.4 million in financial losses from BEC attacks in 2023 alone — and that figure represents only what was reported. The actual number is significantly higher.
Why Small Businesses Are the Primary Target
Large corporations have accounts payable departments with formal verification processes. A small business has one administrator who processes invoices, is trusted to exercise judgement, and doesn't have a colleague to verify with before making a payment. Attackers know this. They target businesses with 5–50 staff specifically because the controls are lighter and the response time is slower.
The personalisation of BEC attacks has also improved dramatically. In 2019, phishing emails had obvious spelling errors and generic greetings. In 2024, AI-assisted phishing emails are grammatically perfect, correctly reference your industry, use your actual supplier names, and are nearly indistinguishable from legitimate correspondence.
The Technical Controls That Stop This
The Wellington firm's email system had no DMARC, SPF, or DKIM records configured — meaning anyone could send email that appeared to come from their suppliers' domains without any technical barrier. Email security filtering that checks sender reputation, domain age, and behavioural signals would have flagged the message before it reached the inbox.
Optimyze deploys email security filtering as a standard component of every managed IT service — screening inbound email for spoofed senders, lookalike domains, and suspicious link destinations before any message reaches staff inboxes.
The Human Control That Stops This
Technical controls catch most attacks. Process controls catch the rest. The single most effective defence against payment redirection fraud is a simple rule: any change to a supplier's bank account details must be verbally confirmed with the supplier using a phone number from your existing records — not a number provided in the email requesting the change.
This rule, communicated clearly to every person with payment authority, costs nothing. The Wellington firm now has it. They didn't before.
What to Do If It Happens to You
Speed matters. If you realise a fraudulent payment has been made: contact your bank immediately and ask them to recall the payment — some banks can claw back funds within 24 hours if the destination account hasn't been cleared. Report to CERT NZ (cert.govt.nz) and NZ Police. Preserve all the email evidence. Notify your insurance provider if you have cyber cover.
The chance of full recovery drops sharply after 48 hours. Acting immediately is the difference between a bad day and a $47,000 loss.
Phishing doesn't need to outsmart your firewall. It just needs to outsmart one person, once. Layered email security and clear payment verification processes close both gaps.
