The short answer: Most payment redirection fraud starts with an email that looks genuine. Either a mailbox has been taken over, or a lookalike address asks for new bank details. To stop it, verify every payment instruction by phone on a number you already hold. Next, turn on multi-factor sign-in and email filtering in Microsoft 365. Then set alerts for suspicious forwarding and inbox rules, and train staff to pause and check.
This guide is for small and mid-sized financial advisory and brokerage firms in Meath, Cavan, Westmeath, Louth and Dublin. It explains how the fraud works and what to change in your process, your systems and your team.
How payment redirection fraud works
The NCSC’s guidance on business email compromise describes attackers who impersonate “a legitimate business contact”. Their aim is to trick people into transferring money or sensitive data. For an advisory firm, that contact could be a client, a product provider or a colleague. This is how payment redirection fraud usually begins.
There are two common routes. First, a criminal can take over a real mailbox, often after a phishing email steals a password. Alternatively, they can send email from an address that is almost identical to a real one. The NCSC’s SME guidance notes that a fake email “may even continue the thread of a previous email exchange”.
Mailbox takeover and spoofed bank-detail changes
When a mailbox is taken over, the criminal can read past conversations quietly. They learn who pays whom, and when. Then, at the right moment, they send a message asking for a payment to go to a new account.
Spoofed requests are the other common form of payment redirection fraud. FraudSMART, the fraud awareness initiative developed by BPFI, explains invoice re-direction fraud on its website. Often there’s no payment request at first. Instead, the email asks for bank details to be updated. As a result, the next genuine payment goes straight to the fraudster.
Notably, An Garda Síochána warns that victims often don’t know until “the legitimate supplier sends a reminder”. By then, the money may already have moved abroad.
From our own work
We have seen this happen to a client. Their email account was compromised, and a payment went to the wrong party. It’s a reminder that payment redirection fraud is not just something that happens to larger firms.
Verify every payment instruction before money moves
Process is the strongest defence against payment redirection fraud, because it works even when an email looks perfect. The NCSC recommends “a strict call-back verification process for any change in bank details”. Likewise, the Garda crime prevention advice says to contact a known person independently. It warns against using contact details from the email itself.
In practice, a simple written policy might include:
- Call back on a number already on file, never one from the email or attachment.
- Treat any request to change bank details as suspicious until confirmed.
- Require a second person to approve new or changed payee details.
- Tell clients at the outset that your firm will never change bank details by email.
- Check the sender’s full address for small spelling changes.
- Slow down when a message is urgent, secret or unusual.
Above all, staff should feel able to delay a payment while they check. A short delay costs far less than a payment sent to the wrong account.
Microsoft 365 protections against payment redirection fraud
Most advisory firms run email on Microsoft 365. Fortunately, several built-in settings make mailbox takeover much harder, and help you spot it sooner.
Multi-factor sign-in on every account
The NCSC advises enforcing multi-factor authentication “on all email accounts”. So, even if a password is stolen, a criminal still needs the second factor. This includes shared mailboxes and accounts used by part-time staff. In short, it closes the most common door to payment redirection fraud.
Email filtering and domain checks
Good filtering helps catch phishing and lookalike senders before they reach staff. The NCSC also recommends setting up and monitoring SPF, DKIM and DMARC on your own domain. These records make it harder for others to send email that appears to come from your firm.
Alerts on forwarding and inbox rules
Once inside a mailbox, criminals often add rules that forward or hide messages. Consequently, staff may never see a client’s reply. The NCSC lists checking for “suspicious email forwarding rules” as a key response step. Ideally, alerts should flag new forwarding and unusual inbox rules as soon as they appear.
Staff awareness and payment redirection fraud
Technology helps, but people make the payment decisions. The Garda advice on business email compromise says all employees “should be aware of this fraud and receive training”. Short, regular sessions work better than a single annual talk.
Training should cover phishing emails, lookalike addresses and pressure tactics. Equally, it should make clear who to tell if something seems wrong. If a payment has already gone, contact your bank straight away, then report it to the Gardaí.
Hypothetical example
An administrator at a four-person brokerage gets an email from a client’s usual address. It asks the firm to send a policy encashment to a new account. Following policy, she rings the client on the number on file. The client knows nothing about it, so nothing is paid.
When to bring in a managed IT provider
Many small firms have no in-house IT person. In that case, payment redirection fraud defences can slip. Multi-factor sign-in gets skipped for one account, or nobody watches for new forwarding rules.
A managed IT provider can set these controls up properly and keep checking them. It’s worth asking for help if:
- Nobody is sure whether every account has multi-factor sign-in.
- No one reviews sign-in alerts or mailbox rules.
- Staff have never had phishing awareness training.
- Your domain has no DMARC record.
For a wider view of security for advisory firms, see our guide to cybersecurity for financial advisers. If clients send you documents by email, our guide to handling client ID documents securely is also useful. Alternatively, start with our free Cyber Health Check.
How Sweeney Computer Services can help stop payment redirection fraud
Oliver Sweeney founded the company in 1985. Today, we support more than 50 businesses and more than 10 schools from Hurdlestown, Kells, Co. Meath. We set up and manage Microsoft 365 security, including multi-factor sign-in, email filtering and alerts. In addition, our Gold package includes email security and phishing awareness training for staff.
Our helpdesk runs Monday to Friday, 9am to 5:30pm. Read more about our IT support for financial services, cyber security and Microsoft 365 services.
A quick sense-check
Worried about a fake payment request?
Book a short call with Michael Sweeney to review your email security and payment checks.
