Business Email Impersonation Is Scaling: How Southwest Florida Businesses Can Stop Payment Fraud

A routine invoice arrives from a familiar vendor. The contact name is correct, the writing sounds normal, and the message refers to a real project. There is only one change: the vendor says its bank account has changed and asks your team to send the next payment to a new destination.

That small change can be the entire attack.

Business email compromise, or BEC, is fraud built around trust. The attacker may forge a sender, register a look-alike domain, take over a real mailbox, or impersonate an executive, employee, customer, closing agent, contractor, or supplier. The objective is usually to redirect money, payroll, tax documents, credentials, or sensitive business information.

This threat deserves executive attention because it crosses the boundary between cybersecurity and financial operations. Email filtering matters, but the last line of defense is often a person in accounting, operations, human resources, or management deciding whether a request is legitimate.

Why this matters now

Microsoft’s 2026 Digital Defense Report says it detected more than 46 million business contact impersonation attacks over the prior 12 months. The same report says most observed intrusions still began with a person or a credential rather than a software exploit. It also reports that 89% to 95% of phishing attachments led to an attempted theft of credentials.

The financial impact is equally direct. The FBI’s 2025 Internet Crime Report lists 24,768 BEC complaints and more than $3.046 billion in reported losses for the year. That is roughly $123,000 in reported loss per complaint when the two totals are divided—an illustration of the potential severity, not a prediction of what any one victim will lose. The FBI also recorded more than $30 million in reported losses specifically tied to BEC scams involving AI.

These figures measure different things: Microsoft reports detected attacks across its environment, while the FBI reports complaints and adjusted losses submitted to its Internet Crime Complaint Center. They should not be combined. Together, however, they show both the extraordinary volume of impersonation attempts and the real financial damage that successful attacks can cause.

What a modern payment-fraud attack looks like

Modern BEC often avoids the obvious warning signs people learned to expect. There may be no attachment, malware, or conspicuous spelling error. A common sequence looks like this:

1. The attacker learns the business. Public websites, social media, out-of-office replies, vendor portals, compromised mailboxes, and prior email threads can reveal who approves payments, which vendors are active, and when a transaction is expected.
2. The attacker creates trusted context. They may imitate an executive, use a nearly identical domain, or quietly monitor a genuine mailbox until the right invoice or closing date appears.
3. A believable change is introduced. The message asks for a new bank account, an urgent wire, a direct-deposit change, a gift-card purchase, or sensitive employee or customer data.
4. Normal controls are pressured or bypassed. The request may invoke urgency, confidentiality, travel, a deadline, or an unavailable decision-maker.
5. The money moves. Once funds reach the first recipient account, criminals may quickly split or move them again, making recovery harder.

For Southwest Florida businesses, the exposure is broad. Construction firms routinely work with subcontractors and progress payments. Real estate, title, legal, and property-management companies handle time-sensitive transfers. Medical and professional practices receive invoices from many suppliers. Hospitality businesses hire seasonal staff and manage frequent vendor changes. Nonprofits, associations, and local governments may combine public leadership information with formal payment processes. Any organization that pays vendors, changes payroll accounts, or exchanges tax and banking information is a target.

AI makes deception cheaper; it does not replace the attacker’s need for trust

Generative AI can help criminals produce polished messages, translate them, adapt tone, research a target, and generate variations at scale. The FBI says chat generators can create official-sounding messages that mimic executives, while voice cloning can be used in requests involving wire payments. Microsoft reports that AI is increasing the scale, speed, and automation of cybercrime.

That does not mean every convincing message is AI-generated, and it does not mean staff can reliably detect fraud by trying to “spot the AI.” The FBI explicitly notes that not all BEC tactics are AI-enabled. A real mailbox takeover can be more convincing than synthetic text because the attacker can reply inside a legitimate conversation and use accurate signatures, history, and invoice details.

The safer assumption is simple: appearance is not proof of authorization. Familiar language, a known email thread, a caller’s voice, or a video meeting should not be enough to change where money is sent.

The most important control: verify the transaction outside the request

Every business should have a written rule for changes to bank accounts, payment instructions, payroll deposits, and other high-risk records:

Do not approve the change using the contact details or communication path supplied in the request.

Instead, call a known contact using a telephone number already stored in your accounting system, contract, vendor master record, or independently verified directory. If possible, require a second authorized employee to confirm the change and document who was contacted, at what number, when, and what was verified.

The FBI specifically recommends verifying payment requests and any change to an account number or payment procedure in person or by calling the person making the request. The crucial detail is to look up the trusted number independently rather than using a number in the suspicious message.

For large or unusual payments, a business can go further:

• Require two-person approval, with separation between the employee entering the change and the employee releasing the payment.
• Place a hold on newly changed payment instructions before the first transfer.
• Send confirmation of the change to the vendor’s previously known email address and contact.
• Use an agreed verification phrase or documented call-back procedure for sensitive transactions.
• Review vendor-master changes and payment exceptions in a daily or weekly report.
• Never let urgency, seniority, or a claimed confidential deal override the process.

These controls are intentionally independent of email. If an attacker controls the mailbox or thread, an email reply to “confirm” the request simply asks the attacker whether the attacker is legitimate.

Microsoft 365 controls that reduce the opportunity

Financial controls stop a fraudulent request from becoming a fraudulent payment. Microsoft 365 security controls reduce the chance that the request reaches the user or that a real account is taken over.

1. Require phishing-resistant multifactor authentication

Passwords alone are not adequate protection for email. Require MFA for every account, especially administrators, executives, finance, HR, and anyone who can access payment or customer information. Where feasible, prefer phishing-resistant methods such as passkeys, FIDO2 security keys, or certificate-based authentication over methods that can be relayed or socially engineered.

MFA is not a reason to relax monitoring. Attackers can use session theft, malicious consent, adversary-in-the-middle phishing, and fraudulent MFA enrollment. Conditional Access policies, sign-in risk controls, managed-device requirements, and session protections should be matched to the organization’s licenses and operational needs.

2. Turn on and tune impersonation protection

Microsoft Defender for Office 365 can apply impersonation protection to selected users and domains, use mailbox intelligence, and expose impersonation attempts for review. High-value names should include executives, finance leaders, payroll staff, and other people whose authority could induce action.

Microsoft also describes email authentication and anti-spoofing protections using SPF, DKIM, and DMARC. These technologies help receiving systems evaluate whether a message is authorized to use a domain. They reduce domain spoofing, but they do not stop a criminal who controls a legitimate account or uses a look-alike domain. Configuration and monitoring still matter.

3. Protect the mailbox after sign-in

Watch for suspicious forwarding, hidden inbox rules, unusual deletions, new consented applications, changes to authentication methods, risky sign-ins, and abnormal sending patterns. Microsoft lists unknown forwarding, rules that move messages to unusual folders, suspicious sent items, unexpected lockouts, and unexplained profile changes among the signs of a compromised mailbox.

Logging must be retained long enough to investigate, and someone must be responsible for reviewing meaningful alerts. A dashboard nobody owns is not a control.

4. Make reporting easy

Users should have a simple way to report a questionable message without forwarding it around. Reports should reach a monitored queue, receive a prompt response, and trigger a search for related messages across the organization when warranted.

Training should use the organization’s real decisions: bank-change requests, payroll updates, document-sharing invitations, QR codes, tax forms, gift cards, and requests to move a conversation to text or WhatsApp. The goal is not to shame someone for clicking. It is to build a fast pause-and-verify habit.

Where defensive AI can help

AI and machine learning are useful at machine scale. Microsoft says its Defender for Office 365 threat-classification system uses large and small language models together with other machine-learning techniques to classify email threats, including impersonation, invoice fraud, payroll fraud, and task fraud.

Used responsibly, these capabilities can help:

• identify patterns that are difficult to capture with a simple allow/block rule;
• prioritize messages and alerts for investigation;
• correlate a suspicious message with identity and endpoint activity;
• summarize incident evidence for a responder;
• find similar messages across many mailboxes; and
• support targeted simulations and awareness training.

But AI should not autonomously approve a payment, alter bank details, or close an investigation involving material financial risk. Models can miss a subtle fraud, misclassify a legitimate request, or produce an incomplete summary. Sensitive email and financial data also require appropriate access controls, retention, data-loss prevention, and vendor governance.

The right division of labor is clear: AI can help detect, correlate, and prioritize; people operating a documented control must authorize the business transaction.

If a payment has already been sent

Treat the situation as both a financial emergency and a cybersecurity incident.

1. Contact the financial institution immediately. Ask for the fraud department, request a recall or freeze, and provide complete transaction details. The FBI says time is of the essence.
2. File a complaint at IC3.gov. Include the receiving account, amount, timestamps, communications, and any second-hop information available. Preserve the IC3 complaint number.
3. Preserve evidence. Retain original messages, headers, audit logs, sign-in records, rules, forwarding settings, files, call details, and payment records. Do not rely on screenshots alone.
4. Contain any compromised account. Disable or restrict the account as appropriate, revoke active sessions, reset credentials securely, review MFA methods, remove unauthorized applications and roles, and inspect forwarding and inbox rules.
5. Search for the wider impact. Determine whether the attacker accessed SharePoint or OneDrive, sent messages to customers or vendors, created persistence, or changed other financial records.
6. Coordinate communications and obligations. Management, legal counsel, the financial institution, insurance carrier, affected partners, and law enforcement may all need timely information. Notification obligations depend on the facts and should be evaluated by qualified counsel.

The FBI’s 2025 report illustrates why speed matters: its Financial Fraud Kill Chain process was initiated in 3,900 incidents involving about $1.164 billion in attempted theft, and approximately $679 million was frozen. That 58% aggregate success rate does not guarantee recovery, but it shows why immediate reporting can make a material difference.

A practical 30-day plan for Southwest Florida organizations

In the first week

• Write and approve a call-back rule for every change to payment, payroll, or banking information.
• Require two-person approval for high-risk transfers and vendor-master changes.
• Give staff one clearly documented route to report suspicious messages and transactions.
• Confirm that emergency contacts for the bank, cyber insurer, legal counsel, IT provider, and IC3 are accessible even if email is unavailable.

In the next two weeks

• Review MFA coverage, authentication methods, Conditional Access, and administrator accounts.
• Validate SPF, DKIM, and DMARC for every domain that sends business email.
• Review anti-phishing and impersonation settings for executives, finance, HR, and payment personnel.
• Audit external forwarding, inbox rules, user-consented applications, dormant accounts, and privileged roles.
• Confirm audit-log retention and alert ownership.

By day 30

• Run a tabletop exercise that begins with a changed vendor bank account and ends with a simulated call to the bank and IC3 report.
• Test how quickly the team can revoke sessions, inspect a mailbox, search for related messages, and identify affected data.
• Conduct role-based training for the employees who approve payments, payroll changes, closings, or releases of tax and customer data.
• Document exceptions and assign an owner and deadline for each remediation item.

How Managed Intelligence Advisors can help

Business email compromise cannot be solved by purchasing one product. It requires alignment among Microsoft 365 configuration, identity security, financial procedures, employee decisions, monitoring, incident response, and executive accountability.

Managed Intelligence Advisors can help Southwest Florida organizations:

• assess Microsoft 365, Entra ID, Defender, email authentication, and administrative controls;
• identify gaps in MFA, Conditional Access, impersonation protection, forwarding, mailbox rules, application consent, logging, and alert response;
• design vendor-change, payroll-change, and payment-approval procedures with clear separation of duties;
• create a practical BEC incident-response playbook and escalation contact sheet;
• conduct role-specific exercises for executives, accounting, HR, operations, and IT;
• evaluate how AI security features fit the organization’s licensing, data-governance obligations, and risk tolerance; and
• advise leadership on priorities, remediation sequencing, and evidence of control effectiveness.

The objective is not to make every employee a fraud investigator. It is to make the safe action easy, consistent, and verifiable—especially when a request looks legitimate and time feels short.

Suggested call to action: Request a Business Email, Payment-Fraud, and Microsoft 365 Readiness Review from Managed Intelligence Advisors.