Invoice fraud through a hijacked email thread: how the payment goes to the wrong account, and what stops it

A generic pattern, assembled from the public record and from incidents we have worked on. No single company is described.

Business email compromise is the second-costliest category of cybercrime reported to the FBI: almost $3.05 billion in reported losses in 2025, from complaints filed in the United States alone. Most of that money left through one scenario. Not a fake chief executive demanding a wire transfer, and not a crude phishing email, but a genuine invoice conversation that an attacker quietly joined and then redirected.

This article follows that scenario from the first stolen password to the moment the money is gone, because the defences only make sense once you see where each one would have broken the chain. The attack has four stages. Every stage has a control.

The four stages of a thread hijack

Why it works

The attack does not break a technical control. It uses trust that already exists.

• An existing thread is trusted more than a new email. Every security briefing warns about unexpected messages. This one is expected. It has three weeks of history quoted beneath it and the right people in copy.
• Nobody reads the sender’s domain. Outlook shows the display name. The address, when it is visible at all, differs by a letter: rn for m, l for i, a different ending, an added hyphen. Our next article covers lookalike domains on their own.
• The lookalike passes every email check. SPF, DKIM and DMARC prove that a message came from the domain it says it came from. The attacker owns the lookalike domain, so the proof is genuine. Authentication stops spoofing; it does not stop impersonation.
• Finance is measured on paying on time. An invoice marked overdue produces action, not scrutiny, and the attacker chooses the moment when a payment is genuinely due.
• The victim’s own mailbox hides the evidence. With the inbox rules in place, the real supplier’s “we have not received your payment” goes straight to a folder nobody opens.

The controls, stage by stage

The point of the table above is that the chain can be cut in four places. Cut it in all four and a single mistake stops being a disaster.

Stage 1: make the stolen credential useless

We have written about how a mailbox is taken over with MFA on, so briefly: MFA alone does not stop a relayed sign-in. What does is Conditional Access in Entra ID P1, which is inside Business Premium and Microsoft 365 E3. Require a managed device for mail, so a stolen session only works on a device enrolled in Intune. Protect MFA registration, so the attacker cannot add their own phone. Use phishing-resistant methods (passkeys, Windows Hello) for finance and administrators. Block the countries you do not operate in. If every mailbox in your supply chain were protected this way there would be no stage 2; yours can be.

Stage 2: see the watching

The reconnaissance phase is where the attacker is most visible and most ignored. Three things catch it.

• Alerts on inbox rules. Microsoft 365 has a built-in alert policy, “Creation of forwarding/redirect rule”, in every business and enterprise plan. It is rated Informational, which means nobody reads it; raise it, or send it somewhere that is read. “Suspicious email forwarding activity” is rated High and also ships by default. Defender for Cloud Apps adds anomaly detection for rules that delete or move mail, which is the pattern that matters here. Every one of these is worthless unless a named person receives it.
• Block external auto-forwarding in the outbound spam policy, tenant-wide. Nearly no business needs it, and it is the attacker’s favourite way to keep reading after they have lost the session.
• Sign-in risk. Entra ID P2 can block or challenge a sign-in from an anonymous address or an impossible journey on its own, without waiting for a person. In the sign-in logs, a session from a hosting provider’s address range with no device identifier is the signature of a replayed token.

Stage 3: make the lookalike visible

This is where Microsoft 365 does more than most people realise, and where most tenants have it switched off.

• Impersonation protection in Defender for Office 365 Plan 1, which is inside Business Premium. Three parts: user impersonation protects named people (your directors, your finance team, and external contacts such as a key supplier’s accounts clerk, up to 350 of them) against lookalike addresses and display names; domain impersonation protects your own domains and the partner domains you add against one-character variants; and mailbox intelligence learns who each user actually corresponds with and flags a lookalike of a frequent contact without anyone having to list it. None of this is on by default. The Standard preset policy switches it on; a tuned custom policy does it better, because the preset cannot know which supplier domains to protect.
• The External tag. One PowerShell command, Set-ExternalInOutlook -Enabled $true, and every message from outside the organisation carries an External label in Outlook, Outlook on the web and the mobile apps. The moment a “colleague” in a thread acquires the tag, the thread has been moved. Mail flow rules that prepend “[EXTERNAL]” to the subject do the same job more crudely and should be retired before the native tag is enabled, or users see both.
• First contact safety tip. An anti-phishing policy setting that adds a banner the first time a user receives mail from an address, or when an address rarely writes to them. A lookalike domain is, by definition, a first contact.
• Safe Links and Safe Attachments, also in Defender for Office 365 Plan 1, for the attachment that usually carries the “corrected” invoice.

Stage 4: the control that cannot be phished

Everything above reduces the odds. One rule removes them: no change to a payee’s bank details is ever acted on from an email alone. It is confirmed by telephone, to a number the company already holds from before the request, never to a number in the email or in the email’s signature. The same rule applies to new suppliers, to “urgent” payments and to a director’s request from the road.

Written down, the policy fits on an index card:

1. Bank-detail changes and new payees are verified by phone on a number already on file. No exceptions, including for the managing director.
2. Payments above a threshold you set need a second person, who checks the payee against the master record, not against the invoice.
3. Anyone who makes the verification call is thanked, not criticised, whatever it turns out to be.
4. If a supplier says it has changed banks, the finance team also calls the supplier’s known number to say so. Half of these frauds are caught by the real supplier hearing about it.

Technology makes this rule easy to keep. It does not replace it. The companies we see lose money to this attack usually had a verification policy; what they did not have was a culture in which a junior accounts clerk felt able to delay a director’s urgent payment for a phone call.

What each licence gives you against this attack

For most businesses under three hundred users, Business Premium is the right answer: every control in stages 1 to 3 is inside it, at a price per user per month that is a rounding error against one diverted invoice. What it does not include is the finance rule in stage 4, which costs nothing.

The licence you need before anything happens: audit retention

There is a second licensing question, and it is the one businesses discover too late. When a mailbox has been compromised, the investigation depends on logs that were being kept before anyone knew there was a problem. Audit licences cannot be bought after the fact: a record that was not retained is gone.

Two separate systems hold the evidence, and they answer different questions.

• Microsoft Entra sign-in and audit logs answer how did they get in? The sign-in from the hosting provider, the replayed session, the authenticator registered on a phone the user has never owned. Sign-in logs are kept for seven days on a free tenant and thirty days with Entra ID P1, which is inside Business Premium and Microsoft 365 E3.
• Microsoft Purview Audit answers what did they do once inside? Which messages were read, which mailbox searches were run, which inbox rules were created, which files were opened, downloaded or shared, which administrative changes were made. This is the log that tells you whether a specific client’s data was touched, and it is what the breach assessment, the insurer and the regulator will ask for.

Purview Audit comes in two tiers, and the tier is a per-user licence, not a tenant setting. Each user whose activity you want kept at the higher tier needs the licence assigned to them.

Three caveats that Microsoft’s documentation is clear about and sales conversations often are not:

1. Ten-year retention is not “buy E5 and everything is kept for ten years”. Audit Premium gives one year by default for the key workloads. Anything longer needs the 10-Year Audit Log Retention add-on for each user concerned, and a custom retention policy that applies to them.
2. Retention policies are not retroactive. A policy created today keeps records generated from today. It does not recover records that have already aged out.
3. The licence follows the user, not the tenant. Records of users without an Audit Premium licence are kept at the standard tier, whatever their colleagues hold. Records of non-user activity (service principals, system events) are kept for a fixed one year and cannot be extended.

What we recommend. A business on Business Premium that wants long-term evidence for the accounts most likely to be targeted does not need to move everybody to Microsoft 365 E5. Add Audit Premium to the accounts that matter: directors, finance, anyone who approves payments or holds signing authority, and the administrators. On Business Premium that is the Purview Suite for Business Premium add-on, on the November 2026 European list €10.44 per user per month; on E3 it is E5 eDiscovery and Audit at €6.24 or the full Purview Suite at €12.48. If the requirement is “we must be able to reconstruct what happened in the managing director’s mailbox eighteen months ago”, add the 10-Year Audit Log Retention add-on, €2.08 per user per month, and write the retention policy the same day. Current prices are in our catalogue; these were correct when this was written.

Done this way, ten protected accounts cost less per month than one hour of the incident response they make possible, and the rest of the company stays on the licence it already has.

If a payment has already gone

1. Call the bank now, yours and if possible the receiving bank. Recalls succeed in the first hours and rarely after the first day.
2. Report it to the police and keep the reference; banks and insurers will ask for it.
3. Work out whose mailbox was compromised. If the lookalike imitates your supplier, the watching may have happened in their mailbox, not yours; tell them, by phone, today. If it imitates you, treat it as your incident: revoke sessions, reset the password, remove and re-register MFA, and find every inbox rule, forwarding address and application grant the attacker left behind.
4. Find the other victims. An attacker who has read a finance mailbox has seen every supplier and client in it. Search the message trace for the lookalike domain and for any other thread that moved.
5. Preserve the evidence before it ages out: sign-in logs are kept seven days without Entra ID P1, thirty with it; audit logs 180 days on the standard tier, a year on Audit Premium. Export what you have, and if the accounts involved are not on Audit Premium, add it now so that the next six months are kept at the higher tier.
6. Assess the data breach. If personal data in the mailbox was read, GDPR’s seventy-two-hour clock may be running. Decide with your adviser and document the decision.
7. Close the gap that let it happen, or it happens again. A recovered mailbox with the same configuration is the same target.

The takeaway

A thread hijack succeeds because each person in it does one reasonable thing: opens a link, replies to a known contact, pays an invoice that is due. The defences are not about making people suspicious of everything. They are about making the stolen password useless, making the watching visible, making the lookalike wear a label, and making one phone call compulsory before money moves.

Switching those controls on, in report-only mode first so that nobody is locked out, and investigating an incident that has already happened, is what our incident response and hardening service does. A phishing simulation tells you how your own staff respond to the lure before an attacker finds out. Contact us for an initial incident assessment and response estimate.

Questions we are asked about invoice fraud

Worth reading next