Business Email Compromise UK: Anatomy of a £230k Fraud Attempt

The 2024 DSIT Cyber Security Breaches Survey reveals that 50% of UK businesses have experienced some form of cyber breach or attack in the last 12 months, with phishing remaining the primary vector. For firms handling large client deposits, this isn't just an IT statistic; it is a direct threat to the firm's insolvency.

The £230k Anatomy: How Conveyancing Fraud Happens

In our managed SOC UK, we recently forensically reconstructed a near-miss at a mid-sized UK law firm. The target was a routine property transaction. The attackers did not "hack" the server in the traditional sense; they performed a sophisticated business email compromise UK style by intercepting a legitimate thread between a solicitor and a buyer.

By leveraging stolen credentials, the attackers lived in the mailbox for 18 days. They utilized rules within the email client to hide their tracks, deleting incoming legitimate emails and replacing them with forged invoice details. When the solicitor sent the final completion statement, the attacker intercepted it, modified the bank account details, and re-sent it. The firm only avoided the £230,000 loss because the buyer called the solicitor’s office to verify a minor discrepancy in the IBAN formatting—a manual check that is increasingly rare in our automated world.

Why Traditional Email Security UK Fails

Many SMEs assume that having an SPF, DKIM, and DMARC record is sufficient for email security UK. While these are baseline requirements for Cyber Essentials support, they do nothing to prevent an attacker who has already gained access to a user’s session.

We see many firms using legacy setups that allow persistent active sessions without re-authentication. When an attacker gains access via a Phishing-as-a-Service kit, they steal the session token, effectively bypassing traditional MFA. This is where CEO fraud protection efforts often fall short—they look for external spoofing while ignoring internal account takeover.

The 4 Entra ID Controls That Stop BEC

If the law firm in our case study had enforced stricter conditional access, the breach would have been neutralized before the inbox was touched. Here are the 4 Microsoft Entra ID controls we prioritize during cybersecurity consulting London engagements:

1. Conditional Access Policies (CAPs) by Location: Restrict sign-ins to known UK IP ranges or compliant devices. If a login attempt originates from a suspicious VPN or non-standard geography, the system must trigger a mandatory block.
2. Phishing-Resistant MFA (FIDO2/Windows Hello): Move away from push notifications. SMS and app-based TOTP are vulnerable to adversary-in-the-middle (AiTM) attacks. FIDO2 security keys require a physical interaction that an attacker cannot replicate remotely.
3. Continuous Access Evaluation (CAE): Enable CAE to allow Entra ID to revoke sessions in real-time when a user password change or sign-in risk is detected.
4. Impossible Travel Policies: Configure Entra ID Identity Protection to flag logins that occur in geographically impossible timeframes. If a user logs in from London and then from a server in Eastern Europe 30 minutes later, the session should be killed immediately.

Defending Against Invoice Fraud UK SME Risks

Invoice fraud is the primary endgame for most BEC actors. To defend against this, firms must implement a "Verify-Always" protocol for changes to bank details. This is not an IT problem; it is a cultural one. If your staff does not have the authority to halt a payment until a voice-verification call is completed, your Microsoft Entra security monitoring is only doing half the job.

Regulatory Compliance and the FCA

For our FCA-regulated clients, BEC is not just a financial loss—it is a regulatory failure. Under FCA PS21/3 on operational resilience and UK GDPR requirements, a failure to secure client data due to a preventable phishing attack can lead to significant ICO enforcement action. We help firms document their security posture through UK GDPR compliance support, ensuring that technical controls are mapped directly to risk appetite.

Key Takeaways

• BEC is primarily an identity and access management failure, not a perimeter failure.
• Standard MFA is no longer enough; transition to phishing-resistant methods immediately.
• Technical controls must be paired with strict human-verification workflows for all financial transactions.
• Regulatory bodies like the ICO expect documented evidence of proactive security measures.
• Continuous monitoring is mandatory for identifying the "living off the land" techniques attackers use.

Frequently Asked Questions

Is BEC covered by standard cyber insurance?

Most UK policies have specific exclusions for "social engineering" if you cannot prove that basic security controls (like MFA) were implemented and functional.

Can Google Workspace users implement these controls?

Yes, while the terminology differs (Context-Aware Access), Google Workspace security offers similar controls to Entra ID to mitigate BEC risks.

How often should we conduct phishing simulations?

We recommend quarterly simulations that mirror the specific tactics identified by the NCSC, focusing on high-risk departments like Finance and Conveyancing.

What do I do if I suspect a BEC attack?

Immediately initiate your Incident Response Plan. Isolate the affected account, revoke all active sessions, and check for hidden mailbox forwarding rules created by the attacker.

Secure Your Firm Today

Business Email Compromise is a persistent, evolving threat that requires more than just a firewall. At Gridisys, we help firms harden their environments against the specific tactics used by active threat actors. If you are concerned about your firm's susceptibility to BEC or need to review your current security posture, contact our team to schedule a consultation with our senior security analysts.