Client stories / Invoice fraud

An invoice from the CEO. Except it wasn't.

Attackers spent months quietly reading a UK record label's email, then used the CEO's own mailbox to get a £100,000 invoice paid into their account. Here's how it happened, how I locked it down within the hour, and what changed.

By Ashley Adkins. Anonymised with the client's details removed. Published 25 October 2026.

Client: UK record label, around 15 staff
Incident: Email compromise and invoice fraud
Attacker access: Months, unnoticed
Locked down: Within the hour of the call

01What happened

The right invoice, the wrong bank details

While the CEO was away, the finance administrator got an email from the CEO about an invoice they were already expecting. It came from the CEO's real mailbox, used phrases only the CEO would use, and pushed for a payment of around £100,000.

It was the genuine supplier's invoice with one change: the bank details. The administrator paid it. Nobody knew anything was wrong until the real supplier got in touch to chase the money.

The investigation showed the CEO's mailbox had been compromised months earlier. The attackers had been reading along, learning how the CEO wrote and who was due to be paid, and waiting for the right moment.

02Response

How I responded

01
Locked everyone out
Straight after the call I locked down access to every mailbox, changed all the passwords and turned on two-factor authentication. Within the hour the attackers were out.
02
Followed the trail
The Microsoft 365 audit and sign-in logs showed when the attackers had been in each mailbox. The usage logs showed the CEO's entire mailbox had been downloaded a few months earlier.
03
Cut the hidden link
To stay connected, the attackers had set up forwarding rules on every mailbox they'd reached, quietly copying mail out. I disabled every one.
04
Reset everything else
Then the long part: working out which logins had been stored or sent by email over the years, and resetting all of them, from Dropbox to the accounting tools.

03Outcome

The money was gone

None of the £100,000 was recovered. The transfer had already gone through, and with no security controls in place, there was nothing in the way to stop it.

What we could do was make sure it couldn't happen again. The label has worked with me since.

04What changed

New ways of working

Bank detail changes confirmed by phone before anything is paid
Two people sign off every payment
A password manager, with complex, unique passwords only
Two-factor authentication enforced on every account
Conditional access, so sign-ins are checked for where and how they happen
A VPN for working away from the office
Mail forwarding to outside addresses blocked
Email encryption turned on
A separate encrypted email service for sensitive conversations between management
SPF, DKIM and DMARC set up, so the label's domain is harder to fake
Custom Exchange rules to stop outsiders sending staff emails pretending to be a colleague

05Lessons

What your business can take from this

Phone before you pay new bank details

One call to the supplier, on a number you already have, would have stopped this. It costs nothing and beats any technology.

Spotting invoice fraud

A password change isn't enough

Forwarding rules kept working in the background. If a mailbox has been compromised, check for rules and rogue access, not just the password.

If your email is hacked

Turn on MFA everywhere

Two-factor authentication makes a stolen password far less useful, and it's one of the best ways to keep attackers out of a mailbox in the first place.

Turning on MFA