Think before you click: Five ways cyber criminals trick organisations

For Cyber Security Awareness Month, Longwall Security highlighted five common tactics to help recognise and act when something doesn't feel right when it comes to emails.

Criminals exploit trust, urgency and familiar working practices to persuade people to share information, reveal credentials or send money. One of the fastest-growing threats is Business Email Compromise (BEC), where attackers impersonate trusted contacts or misuse genuine email accounts to make fraudulent requests appear legitimate.

Business Email Compromise commonly involves requests for payments, banking changes or sensitive information from someone who appears to be a trusted colleague, executive or supplier.

Five common tactics in business email compromise

1. The urgent request

"I'm in a meeting. Please pay this invoice today and keep it confidential."

Attackers create pressure so you act before checking. Be cautious when urgency or secrecy is used to bypass normal approval processes.

What to do: Pause and verify the request through a trusted, separate channel. Follow your normal approval process, however urgent the message sounds.

2. Executive impersonation

"Can you buy £2,500 in gift cards for me? I'll explain later."

A familiar name or senior job title can make a request harder to question. Criminals exploit this by pretending to be a director, manager or another person with authority.

What to do: Verify unexpected requests for purchases, payments or sensitive information directly with the individual using contact details you already trust.

3. The supplier bank change

"We've changed banks. Please update our details before paying the next invoice."

A routine-looking update can divert a legitimate payment into a criminal's account. This is one of the most common forms of Business Email Compromise and can be difficult to spot. Business Email Compromise attacks frequently use fraudulent payment or bank account change requests to redirect legitimate business funds. 

What to do: Independently verify any bank-detail changes with your supplier using a phone number already on record. Never rely on the number provided in the message.

4. The fake login page

"Your Microsoft 365 access expires today. Sign in now to keep access."

A link may lead to a convincing imitation of a familiar service, designed to steal your login details.

What to do: Open the service through your usual app or saved bookmark. Treat unexpected sign-in prompts and unfamiliar web addresses with caution.

5. The hijacked conversation

"Before we finish, please open the attached document and approve the payment."

Attackers who gain access to a genuine mailbox can misuse existing conversations. A familiar sender and email thread do not guarantee that a new request is safe. 

What to do: Verify unexpected attachments, payment instructions or changes in a conversation through a separate, trusted channel.

The golden rule: Stop. Think. Verify.

Before acting on an unusual request, ask yourself:

• Was I expecting this?
• Does the request seem unusual?
• Have I independently verified it?
• Does it follow our normal process?

If the answer is no, stop and check.

Already clicked a suspicious link, entered your password, shared information, or approved a payment?

Follow your organisation's incident reporting procedure immediately. Prompt reporting gives your IT, security and business teams the best opportunity to investigate, contain the issue and minimise any potential impact.

You do not need to be certain that something is malicious before reporting it.

This blog has been written by Longwall Security, an integrated security and risk partner helping organisations reduce cyber risk and build resilience through people, process and technology.