Business Email Compromise in New Zealand: How the Scam Works and How to Stop It

Business email compromise in New Zealand is a targeted fraud in which criminals impersonate a trusted person or supplier by email and persuade staff to transfer money or change payment details. Once the funds leave the account, recovery is difficult and often incomplete.

The NCSC recorded $12.4 million in direct financial losses in the third quarter of 2025 alone, more than double the previous quarter, driven by a small number of high-value unauthorised transfers linked to business email compromise. Across the full 2025/26 year, direct losses totalled $23.8 million. In Australia, the ASD Annual Cyber Threat Report 2024-25 lists email compromise (with or without financial loss) as the top two self-reported cybercrime types for businesses, and the average cost for a small business sits at A$56,600.

How Business Email Compromise Actually Works

Attackers begin with reconnaissance. They study the target company’s website, LinkedIn profiles, and any publicly available invoices or supplier lists. Next, they use either a spoofed domain that looks almost identical to a real one or a compromised email account belonging to a supplier, lawyer, or internal staff member.

Once inside an account or able to impersonate it, the attacker monitors ongoing conversations. When a large payment or invoice is due, they insert themselves into the thread or send a new message requesting updated bank details or an urgent payment to a new account. Because the email appears to come from a familiar address and often continues an existing conversation, the request looks routine.

The money is usually transferred to an account controlled by the criminal and moved offshore within hours. By the time the legitimate supplier asks where the payment is, the funds are gone.

Why Small and Medium Businesses Are Targeted

Firms with 1 to 50 staff often have fewer formal approval steps, limited dual-control on payments, and no dedicated security monitoring of email accounts. A single compromised mailbox can therefore affect the entire payment process. Construction, professional services, property and legal firms appear frequently in reported New Zealand cases because they handle large, predictable transfers. See our guide to cybersecurity for small businesses in NZ for the wider picture.

The Controls That Stop Most BEC Attacks

Dual-channel verification for every payment change

Any request to alter bank details, create a new payee, or make an urgent transfer must be confirmed by a second channel that is already known and trusted, such as a phone number held on file, not the number supplied in the email. This single procedural rule defeats the majority of successful BEC attempts.

Multi-factor authentication on every mailbox

MFA on Microsoft 365, Google Workspace, and any other email system used for business makes it far harder for an attacker who has obtained a password to stay inside the account.

Technical email authentication

SPF, DKIM, and DMARC records, correctly configured, make it more difficult for outsiders to spoof the company’s own domain. These settings are free to implement but must be checked and maintained.

Staff awareness that focuses on payment requests

Regular security awareness training that includes realistic invoice and payment-change scenarios teaches staff to pause and verify. Short monthly simulations with immediate feedback outperform annual long sessions.

Endpoint and account monitoring

Behavioural endpoint detection and response can flag unusual login locations or mass forwarding rules that attackers often create once they control a mailbox. Continuous monitoring of privileged accounts adds another layer.

What to Do in the First Hours After a Suspected BEC

Five key steps after a suspected BEC attack.

1. Contact the bank immediately and request a recall or freeze if the funds have not yet left the country.
2. Secure the compromised account: change passwords, revoke sessions, remove any forwarding rules or new mailbox rules the attacker may have created.
3. Notify any customers or suppliers who may have received fraudulent messages from the account.
4. Report the incident to the NCSC and, if personal information is involved and serious harm is likely, assess notification under the Privacy Act 2020 using the Office of the Privacy Commissioner’s NotifyUs tool.
5. Preserve evidence for investigation and for any insurance claim.

A pre-agreed security incident response arrangement shortens these steps because contact details, decision authority and technical actions are already documented.

Managed Detection as the Operational Layer

Technical controls and staff training reduce risk, yet many small teams still lack someone watching for the early signs of account takeover. Managed detection and response supplies that continuous oversight. CyberMark runs Bitdefender EDR across endpoints, monitors for anomalous email and login behaviour, and provides New Zealand-based investigation when something looks wrong. Plans start at $25 NZD per endpoint per month with an optional 24/7 add-on.

Which Business Email Compromise Defences Should You Put in Place First?

Begin with dual-channel verification of every payment-change request and MFA on every mailbox. Add correct SPF, DKIM and DMARC records, then introduce regular payment-focused phishing simulations. Once those four steps are working, decide whether continuous monitoring of accounts and endpoints would close the remaining gap.

A free security assessment reviews your current email configuration, payment processes and staff exposure and shows the highest-priority gaps. Contact us to arrange that conversation.

Business Email Compromise FAQs

What is business email compromise?

Business email compromise is a fraud in which criminals impersonate a trusted executive, supplier or internal staff member by email and persuade someone to transfer money or change payment details.

How do most BEC attacks start in New Zealand?

Most begin with either a compromised genuine email account or a carefully spoofed domain, followed by monitoring of real payment conversations so the fraudulent request looks routine.

Can a small business recover money lost to BEC?

Recovery depends on how quickly the bank is notified. Funds that have already left the country are rarely recovered in full. Immediate contact with the bank is the first practical step.

Does the Privacy Act 2020 apply to a BEC incident?

Yes, if personal information was accessed or is at risk of unauthorised disclosure and serious harm is likely. The Office of the Privacy Commissioner’s NotifyUs tool helps assess whether notification is required.

Is MFA enough to stop business email compromise?

MFA is one of the strongest single controls, yet it must be paired with dual-channel verification of payment changes and staff who know to pause when an urgent request arrives by email.