“They Paid the Hacker. And It Was Our Invoice.”
It was just after 9AM when my phone rang. I didn’t know it then, but on the other end of that call was a woman whose business had just stepped into a cyber nightmare.
Her voice was shaky — the kind of shake that comes from adrenaline and fear mixing into panic.
“Our email was hacked… the attacker sent an invoice to one of our clients… and they paid it.”
I’ve heard stories like this before. Many times. But each one feels personal — especially when you realize it could’ve been prevented with something as simple as a conversation.
This Wasn’t a Big Corporation — It Was a Local Business
This wasn’t some Fortune 500 company with a war chest and a cybersecurity team tucked away in a shiny glass tower. This was a family business. Two partners. One Windows laptop. A couple of mobile phones. A WordPress website. A business built with care, grit, and community — not firewalls and forensics.
But attackers don’t care about that. They don’t care how hard you worked to build it.
They care how easy it is to take.
And this business? It was easy.
The Perfect Con
The attacker gained access to their Microsoft 365 account. They snooped quietly — no alerts, no red flags, no sirens — and they waited. Then they found an invoice. Copied it perfectly. Same format. Same tone. Same client relationship. But just one tiny, deadly change: the bank account details.
Still ANZ, just not their ANZ.
That one change turned trust into betrayal — and the client, none the wiser, transferred the money.
Thousands. Gone. No mistakes. No suspicion. Just another day in the inbox. This is the anatomy of a BEC (Business Email Compromise) attack: silent inbox access, patient observation, invoice cloning, and a swap of bank details. It’s quiet. It’s quick. And it works
They Got Lucky. Most Don’t.
By sheer luck — and I mean, thank the heavens kind of luck — the client flagged something with their bank before the money cleared. The transfer was frozen. The situation defused.
But let’s be honest. The grenade had already been thrown. It just didn’t detonate.
Reality Check: You Don’t Pay for Security… Until You Pay For It
The harsh reality is that most business email compromise (BEC) attacks don’t start with a brute force hack — they start with poor email security, weak passwords, and a false sense of safety. What followed was a hard conversation. I walked her through the breach — how it happened, why it worked, and what would have stopped it. She listened closely. Nodded in disbelief. She kept asking, “How much would that kind of protection cost?”
When I said $300 a month, her eyes widened.
“That sounds a bit expensive…”
That sentence sat in the room like smoke.
Let’s talk about what “expensive” really means.
Expensive is $40,000 vanishing from your client’s bank account.
Expensive is your reputation crumbling with one phone call that starts with, “I’m so sorry, but…”
Expensive is the sleepless nights, the cold sweat, the trust that took years to build — gone in seconds.
Expensive is a small business surviving a pandemic, a recession, supply chain chaos — only to be gutted by an email.
What’s not expensive? Ten bucks a day. The price of a flat white and a muffin.
Why Attackers Love Small Business
You see, we have this illusion in small business — that cybersecurity is for the big guys. That it’s a luxury. That “it won’t happen to us.” That we’re too small to matter.
But in 2025, attackers aren’t looking for challenge. They’re looking for convenience.
They’re not casing the bank.
They’re casing the coffee shop next door that sends unencrypted invoices over public Wi-Fi and reuses the same password for everything.
They don’t need a master plan. Just an unlocked door.
What This Business Really Needed
This business didn’t need a fortress. They didn’t need a million-dollar setup.
They needed multi-factor authentication — the app-based kind, not those SMS codes hackers can intercept with one hand tied behind their back.
They needed conditional access — to lock out anyone not in Australia and anyone using unapproved devices.
They needed a password manager — so credentials weren’t scattered across notes, inboxes, or someone’s memory.
They needed proper email security — to catch imposters before they ever made it to the inbox.
They needed backups — secure, immutable, tested, and ready to roll if disaster ever struck again.
And they needed someone — anyone — to help them connect the dots before things fell apart.
That’s all.
It would’ve cost them less than their weekly Uber Eats habit.
But no one told them until it was almost too late.
This Happens Every. Single. Day.
What really keeps me up at night is knowing that this story isn’t unique. It’s common. It’s playing out across Australia, right now, in businesses just like yours.
An inbox gets popped.
A payment gets sent.
A business gets burned.
And the tragedy? Most don’t even realize how preventable it all is.
Your Business Deserves Better Than Blind Hope
If you’re a business owner reading this, and your security strategy begins and ends with “we’ve never had a problem,” then I’m talking to you.
It’s not about if.
It’s about when.
And whether you’re prepared when that moment arrives.
You don’t need to be scared. But you do need to be smart.
Smart means taking action before you’re a headline.
Smart means protecting your data, your clients, and your cash flow — because the truth is, no one else will.
Let’s Chat Over That Latte
If you’ve never reviewed how your business would handle a BEC incident, now is the time. One email shouldn’t be the reason your business collapses. Let’s have a conversation. No jargon. No pressure. No salesy nonsense.
Just 15 minutes to review where you’re vulnerable, what you can fix quickly, and how you can sleep better knowing you’re not next.
Because the next attacker?
They don’t care about your logo, your family story, or your late nights at the office.
They care whether your email is easy to break into.
- Make it harder.
- Make it boring.
- Make it not worth their time.
Forward This to Someone You Care About
And if you know someone else running a business like this — please, forward this post.
You might just save them a heartbreak that no insurance can cover.
📞 Call us on 1300 024 748
📧 Email [email protected]
🌐 Visit our website at Managed Services Australia
