Why Your Spam Filter Did Not Stop the Fake Invoice

Your spam filter did not stop the email because there was almost certainly nothing in it to stop. No attachment. No dodgy link. No misspelt domain, no strange formatting, and quite possibly a legitimate sending address belonging to a real business you already pay. A filter scores an email's content, and a well-built business email compromise carries none of the content a filter scores. As far as any scanning engine could tell, the message that moved your money was ordinary business correspondence. It was written to be.

That is a hard thing to accept when the fake invoice has already been paid, because the filter is the thing you can point at on an invoice of your own. You bought protection, and the attack walked straight past it. But the filter was never the control standing between that email and your bank account. The Australian Signals Directorate (ASD) classifies business email compromise as a form of targeted phishing, or spear phishing, and describes it as criminals using email to abuse trust in business processes to scam organisations out of money or goods. The word doing the work in that definition is processes. The attack was aimed at the sequence of steps by which your business agrees to pay someone, and it succeeded at the step where a person made a routine decision about money. Once you see that, you can see where the defence actually lives. It is not in the filter.

TL;DR: What to remember

• ✅ A filter scores an email's content. A well-built business email compromise contains nothing to score, and may arrive from a genuine account the criminal has taken over. The filter did not fail. It was never the right control for this.
• ✅ The attack targets your payment process, so the durable defences change the process: no bank detail change actioned without a call to a number you already held, and a second set of eyes on payments above a threshold you choose deliberately.
• ✅ Multi-factor authentication closes the most common way in, and it is a starting position rather than a finish line. ASD's own maturity model accounts for attackers who defeat weaker implementations.
• ✅ If money has already moved, call your bank on their official number first. Then check the mailbox for rules nobody created before you decide the incident is over.

Contents

• The filter did the job it was built for
• The attack is researched, staged and timed around your money
• The warning signs are small and easy to shrug off
• The controls that stop it live in your payment process
• If the money has already left
• After the money moves: the common questions

The filter did the job it was built for

Email filtering is genuinely good at what it was built for: known malicious attachments, links to known bad destinations, sending infrastructure with a poor reputation, spoofed domains that fail authentication checks, and language patterns matching known bulk campaigns. It catches an enormous volume of that every day, quietly. The reason most Australian businesses rarely think about email security is that this layer mostly works.

Now put the email that cost you money next to that list. "Hi, our bank has changed. Could you update the details for the next invoice? New details below." Sent from a real company's real mailbox, by someone who has been reading that mailbox for three weeks, replying inside an existing thread, using the sender's ordinary phrasing and their actual signature block.

There is nothing there to score. The domain is legitimate and authenticates correctly. The reputation is clean. No attachment, no link. The language is unremarkable because it is genuinely ordinary business language. A filter aggressive enough to block that email would block your actual suppliers, and that trade-off is precisely what filters are engineered to avoid. The product did its job. The attack was built somewhere the product does not look.

The attack is researched, staged and timed around your money

ASD describes two broad routes: criminals using email to pretend to be business representatives, and criminals using the compromised email accounts of employees. The second is the harder one to catch technically, because everything about it is real except the intent. It usually runs in stages, and each stage is aimed at the payment, not the technology.

First, they get in

Credentials are obtained, commonly through a convincing sign-in page, through a password reused from an unrelated breach, or through an attack on weak multi-factor authentication. Nothing dramatic happens at this point. Nobody notices, because there is nothing yet to notice.

Then they read your mail

This is the stage businesses underestimate, and it is the one that makes the final email so convincing. The criminal reads. They learn who approves payments, how your invoices are worded, which suppliers are mid-project, when the finance officer takes leave, and how people in your business talk to each other. The research is the product. Everything that follows is spending it.

Then they quietly rearrange the mailbox

Mailbox rules get created so that certain messages are forwarded, deleted, or moved into an obscure folder. The rule keeps the real conversation away from the real person while the fake one proceeds. Your supplier replies "we never sent that", and the reply vanishes into a folder nobody opens. It is a small piece of configuration, and it buys the criminal the days they need.

Then one email asks for the money

One message, precisely timed, usually attached to a genuine transaction that is already expected. The amount is plausible and the timing is plausible because both were researched. Nobody on your team was careless. They were asked to do the ordinary thing, by what looked like the ordinary person, at the one moment the ordinary thing was wrong. Bank details do change. Suppliers do send revised invoices. The request defeats scepticism by being unremarkable.

The variant that never touches your systems

The other route ASD names does not involve compromising anybody's account at all. A criminal registers a domain that reads almost identically to a real one, a swapped letter, an added hyphen, a different top-level ending, and simply writes from it. Nothing has been breached, so there is no login alert, no mailbox rule and no forensic trail inside your environment. Domain authentication checks pass, because the criminal genuinely owns the lookalike domain they are sending from. This one matters to understand because it is invisible to every control that watches your own systems. The only things standing between it and a payment are somebody noticing the address is subtly wrong, or a process that verifies the change no matter what the address says. One of those two is reliable.

The warning signs are small and easy to shrug off

ASD names several indicators, and they are worth putting in front of anyone who touches invoices or works out of a shared mailbox.

• A colleague, supplier or customer mentions receiving a suspicious email from you that you did not send. This is often the first sign, and it usually arrives as an offhand comment rather than a report.
• Unusual emails in your own account about suspicious login activity or unexpected password resets.
• Emails that have been deleted or moved to different folders without explanation. That is the mailbox rule doing its work, and it is the most reliable technical indicator on the list.

Look at the first two again. They depend entirely on somebody feeling comfortable enough to mention something small. That is a cultural control, and it deserves to be named as one: a team that treats a mistaken click as a disciplinary matter hears about incidents later than a team that does not, and in this attack, later is measured in dollars.

The controls that stop it live in your payment process

If the attack targets a process, the durable controls are the ones that change how the process works, backed by technical measures that reduce how often anyone has to make a judgement call at all.

No bank detail change without a phone call

A standing rule that no change to payment details is actioned without a call to a number you already held, never a number supplied in the email. This is the cheapest control on the list and the one that most directly breaks the step the whole attack depends on. It works against the compromised account and it works against the lookalike domain, because it does not care what the email says.

Multi-factor authentication that survives a prepared attacker

ASD's maturity model explicitly distinguishes attackers who circumvent weak multi-factor authentication from those who can defeat stronger implementations by stealing authentication token values. So having multi-factor authentication switched on is a starting position, not a finish line. What matters is which implementation you have and which accounts it actually covers.

An alert the day a mailbox rule appears

If a rule that forwards or deletes mail gets created, somebody should know that day, not during the post-incident review. The rule is the attack's quietest and most useful tool. Take away the quiet and you have taken away most of its value.

Fewer people with elevated access

Least privilege on finance systems and mailboxes limits what any single compromised account can reach. Restricting administrative privileges is one of the eight ASD mitigation strategies for exactly this class of reason: the fewer doors a stolen credential opens, the less the theft is worth.

A second set of eyes above a threshold you set on purpose

Payments above a deliberate threshold get a second approver. One person deciding alone under time pressure is exactly what the timing was built to produce, and a second signature takes that pressure off the decision. Time pressure is a tool the criminal chose the moment they chose when to send.

Read back through those five and notice how little of it is a product you can buy. It is process design, configuration and monitoring, which is why it tends to fall through the gap between a business that assumes its IT provider covers it and a provider whose contract covers the infrastructure rather than the invoice workflow. inSUPPORT treats these controls as part of the ongoing method rather than a one-off project, because a mailbox rule alert configured once and never watched is not a control. It is a setting.

If the money has already left

Call the bank first, on the number printed on your card or its official website, not any number sitting in the email thread. The sooner a transfer is flagged, the better the chance of stopping or recalling it. Then check the mailbox the request came from for forwarding rules or filters nobody set up, because the account may still be under someone else's control and the next invoice is already being written. ASD's guidance on reporting and recovering from business email compromise sets out who else to notify from there.

After the money moves: the common questions

Would a better spam filter have stopped this?
No, and pretending otherwise usually just sells an upgrade that changes nothing. Filtering is a valuable layer and it should be well configured. But an email with no malicious content, sent from a legitimate compromised account, is close to the definition of what a filter cannot catch without also blocking your real correspondence. Buy the upgrade if the audit says your filtering is weak. Do not buy it as the fix for this.

Is this the same as phishing?
It is a form of it. ASD describes business email compromise as targeted phishing, or spear phishing. The practical difference is the research: ordinary phishing goes to thousands of people and plays the percentages, while this was written for your business after somebody read your mail. That is also why the generic training examples with the bad spelling and the strange links often fail to prepare people for the real thing. The real thing reads well.

Does multi-factor authentication solve it?
It closes the most common entry route, and it does not finish the job on its own. ASD's own maturity descriptions account for attackers defeating weaker implementations, and no authentication control prevents an invoice fraud run purely by impersonation from a lookalike domain, where no account is compromised at all. Layer it with the phone call rule. The two together cover what either one alone misses.

How long do attackers usually sit in a mailbox?
Long enough to learn your payment cycle. That is the only honest answer, because it varies with what they are waiting for. The operational point matters more than the number: treat a period of observation as likely rather than assumed away, and check for mailbox rules and forwarding before concluding an incident is closed. An attacker who kept their access has no reason to stop at one invoice.

Citations

• "Business email compromise", Australian Signals Directorate. Defines business email compromise as targeted phishing that abuses trust in business processes, describes both impersonation and compromised-account routes, and lists the indicators used above. cyber.gov.au
• "Report and recover from business email compromise", Australian Signals Directorate. The recovery sequence and the parties to notify, including the instruction to call your financial institution on their official number. cyber.gov.au
• "Essential Eight maturity model", Australian Signals Directorate. The source of the distinction between attackers who circumvent weak multi-factor authentication and those who defeat stronger implementations by stealing authentication token values. cyber.gov.au

Related Reading

• Let's Talk About Passwords
• What is Cybersecurity
• The 6 Step Cyber Strength System
• Security, compliance and support run as one model

Content reviewed by Probably Genius for accuracy and relevance.

inSUPPORT provides managed IT and cyber security services. It is not an insurer, insurance broker or underwriter and does not hold an Australian Financial Services Licence. Where cyber insurance forms part of a plan, it is arranged through licensed insurance partners and underwritten by the insurer. Cover is subject to the insurer's assessment, the policy terms and the Product Disclosure Statement and Target Market Determination. This article is general information about IT and security practice, not financial product advice, and it does not take account of your objectives, financial situation or needs.