When a cyberattack remains completely undetected
Not every cyberattack cripples systems or leaves servers encrypted. Some attacks go unnoticed for weeks and exploit the very things companies rely on every day: email, processes, and familiar contacts. This fictional story is based on typical experiences from incident response operations and illustrates how attackers exploit legitimate communication to divert large sums of money.
There’s no dramatic twist to this story. No server crashes, no screen goes black, no ransom demand appears. If you’re looking for the day it all began, you have to go back two weeks to an email that contained a link to a fake login page for the email provider. On a hectic Thursday, the retail company’s CFO entered her password. The page reported an error and she tried again. It worked and she never gave it another thought.
From that Thursday on, someone was reading her emails. Quietly, patiently, professionally. The attacker set up an inconspicuous forwarding rule in the inbox and got to know the company: which suppliers send invoices and when, the tone the CFO uses in her emails, how she signs off on them, who authorizes payments, and who processes them. He also learned that a large invoice from a long-standing overseas supplier would be due soon. For two weeks, he did nothing.
Tuesday, 11:05 a.m. There’s an email from the supplier in the accountant’s inbox: the real invoice, the real amount, the real project. Only one detail is new: “Please note our updated bank account information.” The sender is correct, the signature is correct, the tone is right, even the typo that the supplier’s clerk has been making for years is there. The accountant does what the procedures call for: he checks. At 11:22 a.m., he writes to the CFO: “New bank details for [supplier], can you confirm this?” At 11:28 a.m., the reply arrives from her account: “That’s correct. I verified it with them over the phone. Please process this today, or else we’ll incur late fees.” Except: she didn’t write that reply. The attacker had access to the email account and answered the verification question himself. At 11:31 a.m., the accountant authorizes the transfer of CHF 380’000. The dual-control principle worked—both sets of eyes were simply looking at the same compromised channel.
For twelve days, the incorrect bank transfer goes unnoticed. Then, one Monday, the real supplier calls and politely asks when the payment is expected. That’s when the accountant’s blood runs cold. He pulls up the payment confirmation, the supplier gives his account number, and the two numbers don’t match. At 4:40 p.m. that same day, the CFO dials the number for baseVISION’s CSIRT, not because of a system failure, but because of a statement that can no longer be disputed: “I think someone sent a message in my name.”
What follows is a forensic investigation: logins from time zones where no one from the company has ever been, cleverly hidden mailbox rules, and deleted messages in the “Sent Items” folder that no one from the company ever sent. The forensic investigator reconstructs the events going back three weeks, answering the questions on which everything now hinges: When did this start? Was it just this one account, or several? Were additional payments being prepared? Did customer data leak, and what does that mean in terms of reporting requirements? The company’s bank is notified that same evening, and the recipient bank is contacted; unfortunately, the funds have already been transferred and can no longer be recovered. Every hour between discovery and reporting costs real money.
On Day 21, the facts are clear. The good news: It was just that one payment; no customer data was leaked. The backdoors are closed and the accounts have been set up again with phishing-resistant login. The bad news: A six-figure sum is gone for good. The accountant, who wanted to do everything right, takes a long time to stop seeing that 11:31 a.m. approval request in front of him every day. During the wrap-up meeting, the CFO says the one sentence that sums up the whole story: “We thought an attack would look like an attack. No one had considered that a genuine invoice and a reply from their own inbox could be the trap.” Today, the company follows a simple rule: Bank account details are never changed via email—every change is verified through a second, independent channel.
Are you prepared for payment fraud?
The story “11:31 – The Silent Bank Transfer” shows that modern attacks often go unnoticed. A compromised email account, a genuine invoice, and supposedly verified bank account information are all it takes to divert large sums of money.
When bank account information needs to be updated, critical follow-up questions are often asked via email. This is exactly what attackers exploit.
In many cases, the problem isn’t a lack of processes, but rather blind trust in a single communication channel. A second, independent verification method can make all the difference. Based on typical cases of business email compromise and payment fraud, we have summarized the most important warning signs and protective measures in a concise fact sheet.
The sooner an incident is detected, the more options there are for taking action.
Business email compromise is one of the most difficult cyberattacks to detect. There is no encrypted server, no visible disruption, and often no warning message. Companies often don’t notice the incident until a payment fails to go through or a supplier inquires about it.
From this point on, every hour counts. The faster compromised accounts can be identified, evidence secured, and further risks investigated, the greater the chance of preventing additional damage.
Through our incident response hotline and incident response retainer, we help companies analyze, contain, and conduct forensic investigations of security incidents. This ensures that affected organizations can quickly access experienced specialists in the event of an emergency.
