🛡️ Cybersecurity Monthly
June 2026 Edition
Trust Is the Target – Business Email Compromise & Invoice Fraud Explained
June 2026 Edition
Trust Is the Target – Business Email Compromise & Invoice Fraud Explained
Hi 👋,
Welcome to the Morcan Cybersecurity Monthly — your June update focused on Business Email Compromise (BEC), invoice fraud and payment impersonation. These attacks are often low-tech but highly convincing: attackers exploit trust, urgency and routine business processes to trick people into sending money or sharing sensitive information.
💷 NCSC guidance: business payment fraud remains a major risk
The NCSC warns that criminals can impersonate trusted contacts, send realistic invoices,
or request payments to new bank accounts. This is commonly known as Business Email Compromise.
Read more →
📧 Action Fraud: invoice redirection and BEC scams target normal business processes
Business Email Compromise scams often rely on compromised or spoofed email accounts,
supplier impersonation and urgent payment requests.
Read more →
🏦 Fraud strategy: impersonation remains a key UK fraud challenge
UK fraud guidance continues to highlight criminals impersonating legitimate organisations
and exploiting trust to cause financial harm.
Read more →
Core message: Attackers don’t always need to hack systems. Sometimes they simply manipulate trust.
Business Email Compromise is when criminals impersonate a supplier, colleague, executive, finance contact or trusted organisation to trick someone into making a payment, changing bank details, sharing data or bypassing normal process.
Attackers research the organisation before making contact. They may look at company websites, LinkedIn, job titles, supplier names, email formats, out-of-office posts and public documents.
Key lesson: Attackers often know more about the business than users expect.
The first message usually looks routine. It might be a fake invoice, a supplier request, a SharePoint link, a “quick favour” from a manager, or a message about updated payment details.
Key lesson: BEC emails are often targeted and believable — not obviously malicious.
Modern attackers can be patient. They may continue conversations over several days, mirror normal language, use realistic signatures, or even reply inside a real email thread if an account has been compromised.
Key lesson: A familiar tone or previous email chain does not automatically make a request safe.
Key lesson: Urgency + authority + secrecy = major red flags.
The attack may only be discovered when a supplier chases payment, finance spots an anomaly, or a user notices strange replies. By then, money may have been transferred, data may have been shared, or internal phishing may have begun.
BEC works because it exploits normal human behaviour. Attackers rely on:
The best defence is not suspicion of everyone — it is following process even when the request feels familiar.
Recon: Be mindful of what you share publicly about roles, suppliers and absences.
Email arrives: Pause, inspect the sender and question unusual requests.
Payment change: Verify using a known phone number, not the details in the email.
Urgent pressure: Slow down and follow process.
Mistake made: Report immediately — speed can reduce or stop losses.
Simple checks that stop invoice fraud, supplier impersonation and executive spoofing.
☐ Treat all bank detail changes as high-risk
☐ Verify payment changes verbally using a known phone number
☐ Never rely on email alone for payment changes
☐ Use a second-person approval for new payees or changed details
☐ Check the sender address, not just the display name
☐ Be suspicious of urgency, secrecy or pressure
☐ Watch for slight domain changes or unusual wording
☐ Be careful with “updated invoice” attachments and links
☐ Question unusual payment, gift card or confidential requests
☐ Confirm via Teams, phone or another trusted channel
☐ Do not bypass process because someone sounds senior
☐ If unsure, ask Finance, IT or SecOps before acting
Golden rule: If money, data or bank details are involved — verify before you act.
Mistakes happen. What matters most is speed.
Fast reporting can sometimes stop or recover payments, preserve evidence, and prevent further emails being sent to colleagues or suppliers.
⏱️ Speed matters enormously.
Early reporting can reduce losses and protect the wider organisation.
Read the email and identify five warning signs.
From: Mark Evans <mark.evans@suppller-payments.co.uk>
Subject: URGENT: Updated bank details for outstanding invoice
Hi,
We’ve changed banks and need this paid today to avoid service disruption.
Please use the attached updated invoice and confirm once sent.
I’m unavailable by phone due to meetings — email only please.
Attachment: Invoice_Update_June.pdf
Answer ideas: urgency, “email only”, changed bank details, suspicious domain spelling, attachment pressure, service disruption threat.
Choose the safest action for each scenario.
1. A supplier emails new bank details.
A) Approve B) Verify
2. Your director emails asking for gift cards while “in a meeting”.
A) Approve B) Verify
3. Finance asks you to confirm a normal invoice using the approved workflow.
A) Approve B) Verify
4. A supplier says “don’t call, email only” for an urgent payment change.
A) Approve B) Verify
Answers: 1) Verify · 2) Verify · 3) Approve if expected and within process · 4) Verify
Which phrase is the biggest red flag?
A) “Please use the approved purchase order process.”
B) “Can you verify this through the supplier portal?”
C) “This is urgent and confidential — don’t discuss it with anyone.”
Answer: C — urgency plus secrecy is a classic social engineering tactic.
Stay safe and cyber-smart 💡
— The Morcan Cyber Team
Morcan | Cybersecurity Advisory
June 2026