Flare · Business email compromise

A supplier's bank details changed. Now the money is gone.

Business email compromise is one of the most common ways Australian businesses lose money to cybercrime. Someone gets into a mailbox, watches the conversation, then sends a convincing message asking for payment to a new account. Sometimes it comes from your mailbox. Sometimes from your supplier's.

Speed matters on two fronts. Your bank may be able to recall the payment if it hears quickly. And the evidence of how the attacker got in starts to disappear as soon as people begin changing passwords and deleting emails.

Call 1300 027 401 (24/7) Send an enquiry

Signs it may be business email compromise

→A supplier, client or staff member says they never received a payment you sent.
→An invoice or email asked for payment to new bank details, often with urgency.
→Emails in a mailbox are being forwarded, moved or deleted by rules nobody created.
→Clients received emails from your address that your staff did not send.
→A sign-in alert, MFA prompt or password reset appeared that nobody requested.

Do these now

01

Call your bank

Tell them it is a suspected fraudulent payment and ask them to attempt a recall. Have the date, amount and receiving account details ready.
02

Don't delete anything

Leave the suspicious emails, rules and invoices where they are. They show how the attacker got in and what they saw.
03

Secure the account carefully

Change the password and sign out all sessions for the affected mailbox. If you are unsure how without losing evidence, call us first.
04

Warn the other side

Call, don't email, the supplier or client involved. Their mailbox may be the one that was compromised.

What Flare does

How we help

Confirm how they got in

We examine sign-in records, mailbox rules and message history to establish which account was compromised, when, and from where.

Check it's contained

We work with your IT team or provider to confirm the attacker no longer has access, and look for any other accounts they reached.

Establish what they saw

We determine which emails and attachments the attacker could access. That answers whether personal information was exposed and whether you may have a notification obligation.

Report for your bank, insurer and lawyers

You receive a clear written account of what happened, suitable for an insurance claim, a bank dispute or legal advice.

Whether the money comes back is often decided by the bank in the first hours. What we can give you is a clear, evidenced picture of what happened, confirmation the attacker is out, and the facts your insurer and lawyers will ask for.

Having a cyber incident?

Call now. The line is answered 24/7, and early action protects evidence and money.

Call 1300 027 401 First-hour checklist

Common questions

Can you get the money back?

Recovery depends on how quickly the bank acts and where the funds went, so we can't promise it. Your bank is the first call. Our work gives the bank, police and your insurer the evidence they need.

Was it our mailbox or theirs?

That is usually one of the first questions we answer. Sign-in records and message headers normally show which side was compromised.

Do we have to tell anyone?

If personal information was in the mailbox, you may have obligations under the Notifiable Data Breaches scheme. Our findings help you and your lawyer make that assessment.

Our IT provider has already reset everything. Is it too late?

Not necessarily. Many records are held in the cloud platform for a period of time. The sooner we start, the more is available.

Testimonials

Trusted when it matters

"Mark and the team have been invaluable to me and my businesses. Their responsiveness is second to none, and their "bedside manner" is unparalleled. In the moments you need Sicarius the most, Mark and his team know you need experts that care and that is why I trust them implicitly."

Joni Pirovich

CEO · Crystal aOS

Account compromise →Scams and fraud → Read: The invoice that changed: how payment redirection fraud works → All Flare services →