Motta Industries Blog

When people hear “business email compromise,” they usually picture a fake invoice or a spoofed message from the boss asking for a wire transfer. Those scams are real and expensive. But a compromised mailbox rarely stays a single problem. The same inbox often receives password reset links for the website, the domain registrar, the hosting account, the payment processor and a dozen plugins or tools that nobody has looked at in years.

For a small business, that web of quiet logins can turn a stolen email password into a stolen website, a hijacked domain or redirected payments. This guide explains how business email compromise works, why website-related accounts are part of the risk, and how to find and protect the logins nobody is watching.

What business email compromise is

The FBI’s Internet Crime Complaint Center describes business email compromise, or BEC, as a sophisticated scam targeting businesses and individuals who perform legitimate transfer-of-funds requests. In its June 9, 2023 public service announcement, Business Email Compromise: The $50 Billion Scam, the IC3 explained that the scam is frequently carried out when someone compromises legitimate business or personal email accounts through social engineering or computer intrusion to conduct unauthorized transfers of funds.

The announcement also stressed that the scam is not always associated with a transfer request. Some variations involve compromising business email accounts to request employees’ personally identifiable information, W-2 tax forms or cryptocurrency wallets. The PSA reported exposed losses of more than $50.8 billion in domestic and international incidents between October 2013 and December 2022, and a 17% increase in identified global exposed losses between December 2021 and December 2022.

How large the problem is today

The IC3’s 2023 Internet Crime Report put the scale in perspective. The IC3 received 880,418 complaints in 2023, with reported losses of $12.5 billion. In the same year, it received 21,489 BEC complaints with adjusted losses over $2.9 billion.

The report noted that these schemes historically involved compromised vendor emails, requests for W-2 information, targeting of the real estate sector and fraudulent requests for gift cards. More recently, it said, fraudsters are increasingly using custodial accounts at financial institutions for cryptocurrency exchanges or third-party payment processors. The report emphasized the importance of two-factor or multi-factor authentication as an additional security layer, and recommended verifying payment and purchase requests outside of email, including by calling a known, verified number rather than one included in the message.

These figures cover reported complaints only. Many small incidents are never reported, and losses that do not involve a wire transfer, such as a hijacked website or a damaged reputation, are hard to measure at all.

Why email is the master key to your website

Most website-related accounts use email for identity. If someone controls the inbox, they can often request a password reset, read the confirmation code and lock the real owner out. Consider how many services send reset links to a single business address:

• Domain registrar. Controls where your domain points, including email and the website.
• DNS provider. Often the same as the registrar, but sometimes a separate account.
• Hosting account. Controls files, databases and backups.
• Content management system. Admin users can change pages, add users or install code.
• Payment and checkout tools. Settings may include payout bank details.
• Form and email marketing services. These hold customer contact data.
• Analytics and search tools. Ownership can be transferred or new users added.

An attacker who reads the mailbox quietly can also learn which vendors you use, when invoices are due and how your team writes. That information makes later fraud far more convincing.

The logins nobody watches

In many small businesses, website accounts were created by whoever built the site, sometimes years ago. They may be tied to a former employee’s address, a personal email account or a generic inbox that nobody checks. Common blind spots include:

• A registrar account in the name of a past web designer.
• Old administrator users on the website that still have full access.
• Shared logins used by several staff members with one password.
• Plugin or theme marketplaces connected to a forgotten account.
• Automatic notifications, such as security alerts or failed login warnings, that go to an unmonitored address.
• Forwarding rules in email that silently copy messages elsewhere.

None of these is dramatic on its own, and each one may seem harmless when viewed in isolation. Together, they create paths that an attacker can use without anyone noticing.

Step one: build an account inventory

Start by listing every account that touches your website, domain or online payments. For each, record:

1. The service and its purpose.
2. The login email address and who receives messages sent to it.
3. Who has access, and whether each person still needs it.
4. Which authentication methods are enabled.
5. Where recovery codes are stored.

This is often the most revealing exercise. Owners frequently discover accounts they forgot existed or find that a critical login depends on a single person’s personal mailbox. Move important accounts to business-controlled addresses, and make sure at least two trusted people can reach them.

Keep the inventory somewhere secure but accessible, such as a password manager with shared business vaults, rather than a spreadsheet attached to email. Update it whenever someone joins or leaves the company, when you add a new tool, or when a vendor relationship ends. A short annual review is better than none, but tying updates to these everyday events keeps the list accurate.

Step two: strengthen authentication, starting with email

Because email is the master key, protect it first. Turn on multi-factor authentication for every mailbox, then for the registrar, hosting, website admin and payment accounts.

Not all MFA methods are equal. The Cybersecurity and Infrastructure Security Agency’s October 2022 fact sheet, Implementing Number Matching in MFA Applications, described how attackers who already have a password can generate repeated push notifications on a user’s phone. This “MFA fatigue,” also known as push bombing, continues until the user approves the request by accident or out of annoyance.

CISA strongly encouraged organizations to implement phishing-resistant MFA. If that is not yet possible for push-based systems, it recommended number matching as an interim mitigation, a setting that forces the user to enter numbers from the login screen into their app before approving. The fact sheet also recommended training users to report unknown or bulk confirmation requests, and investigating denied push notifications, because MFA checks happen after the password is entered, so a denied request could mean the password is compromised.

For a small team, the practical lesson is simple: an unexpected login prompt is a warning sign, not an annoyance to dismiss.

Step three: watch for quiet changes

Attackers who gain access often try to stay hidden. Look for:

• New email forwarding or filtering rules, especially ones that move messages about invoices or passwords.
• New admin users on the website or hosting account.
• Changes to payout bank details in payment or ecommerce tools.
• DNS changes, such as new mail records or a different website address.
• Unexpected plugin installations or file changes on the server.

Make sure security alerts from each service go to an address that someone actually reads. Review admin user lists and forwarding rules on a regular schedule, such as monthly. Our website maintenance service includes routine checks of users, plugins and updates so these changes are noticed early.

Step four: verify payment and account changes outside email

The IC3 guidance consistently recommends verifying requests through a second channel. The 2023 PSA suggested using secondary channels or two-factor authentication to verify requests for changes in account information, checking that URLs in emails match the business they claim to come from, being alert to misspelled domain names, and not supplying login credentials or personal information by email.

Write these rules down for your team:

• Any request to change bank details is confirmed by calling a known number on file.
• No one shares passwords or codes by email or text.
• Requests marked urgent from executives or vendors get the same verification as any other.
• Staff check the full sender address, especially on phones, where display names can hide the real address.

Step five: secure the hosting and domain layer

Your hosting and domain accounts deserve the same protection as your bank account. Enable registrar lock where available, which helps prevent unauthorized domain transfers. Keep contact details current so renewal and security notices reach you. Store backups somewhere separate from the hosting account so a compromise does not destroy them.

A reliable provider makes this easier. Our web hosting includes managed backups, monitored access and support when something looks wrong.

If something goes wrong

The IC3 advises that if you discover a fraudulent transfer, time is of the essence. Contact your financial institution immediately and request a recall of the funds, then file a complaint at ic3.gov as soon as possible, regardless of the amount lost.

For website and account compromise, act quickly as well:

1. Change the email password from a clean device and sign out all sessions.
2. Remove unknown forwarding rules and recovery options.
3. Reset passwords for registrar, hosting, website and payment accounts.
4. Review admin users and remove anyone unknown.
5. Check DNS settings and payout details.
6. Restore from a clean backup if site files were altered.
7. Tell customers or vendors if they may receive fraudulent messages.

A fictional example

Consider a fictional plumbing supply company. Its office manager received a series of login approval prompts on her phone late one evening and denied them, but did not mention it. Two weeks later, a supplier called to ask why the company had changed its bank account for payments.

Investigation showed that the office manager’s email password had been reused on another site that was breached. The attacker had added a forwarding rule, studied invoices and then sent a convincing message from a lookalike address. Because the supplier verified by phone, no money was lost. The company then built an account inventory, discovered an old website admin user belonging to a former contractor, enabled number matching, moved its registrar account to a shared business address and adopted a rule that denied login prompts are reported the same day.

A business email and website login checklist

• Every website, domain, hosting and payment account is listed.
• Login emails are business-controlled and monitored.
• Former staff and contractors no longer have access.
• MFA is enabled on email first, then all critical accounts.
• Number matching or phishing-resistant methods replace simple push approval.
• Staff report unexpected login prompts.
• Forwarding rules and admin users are reviewed monthly.
• Bank detail changes are verified by phone.
• Registrar lock and separate backups are in place.
• An incident plan lists who to call and what to reset.

Business email compromise often starts with one inbox, but the damage spreads through every account that trusts it. For help reviewing access and protecting your site, explore our trust and security services.