Not a MalwareAnalysis.app client engagement
This case is a published illustration from the Australian Cyber Security Centre’s Small Business Cyber Security Guide (June 2023). It is not work performed by Cybersecurity Engineering Pty Ltd.
A small construction business received mail from a supplier saying the firm had changed banks and attaching new account details. The message looked like the rest of their correspondence, so nobody called. They paid an invoice of more than $70,000. The next day another employee paid the same invoice again. When they asked the supplier to refund the duplicate, the supplier said those details were wrong. One of the supplier’s mailboxes had been taken over and used to send the instruction. No funds were recovered.
A specialist reads two failures. On the supplier side, a mailbox without a second factor is a single stolen password away from becoming a fraud engine. On the buyer side, there was no dual control and no out-of-band confirmation. SPF, DKIM and DMARC would have made raw spoofing harder. They would not have stopped a thief already sitting in a valid mailbox.
The cheap control
Staff should treat payment requests and bank-detail changes as high risk when they are urgent, when the domain is slightly wrong, or when the only evidence is the email itself. Call the sender on a number from existing records or the official website. Building that call into the process costs almost nothing.
Sources
- ACSC Small Business Cyber Security Guide (June 2023).
Accountability
Published by Cybersecurity Engineering Pty Ltd, trading as MalwareAnalysis.app. This is general guidance, not advice about your incident. A named expert profile will be attached once approved for publication. Review this page again after 5 March 2027, or sooner if official ASD or OAIC guidance changes.
Related: The ACSC small business guide, as one account · Business pathway.
Use the evidence in context
This article reflects understanding at its stated publication and review dates. It is general information, not advice about your specific incident, system or legal position.