Why finance is the prime target
If attackers can compromise one finance team member's email, or socially engineer one wire transfer, they can move six figures in minutes. The FBI ranks Business Email Compromise (BEC) as the most expensive cybercrime category — billions annually, almost all through finance teams.
The math attackers care about
Most cyber attacks have a return curve. Ransomware: months of work for a chance at $1M ransom. Stolen credentials: pennies per account on dark markets.
BEC against finance: one well-crafted email, one approved wire, $50K–$5M same-day. No malware, no encryption, just a convincing message and a routine wire transfer.
This is why the FBI ranks BEC as the most-expensive cybercrime category, with annual losses exceeding $2.7B in 2023 (reported only — actual is higher).
The four playbooks aimed at you
1. CEO/CFO impersonation
"Hi [your name] — I'm in a meeting and need a quick wire to close a deal. Can you process $87K to this account? I'll send the agreement after. Time-sensitive."
2. Vendor bank-account change
A real vendor (or convincing impersonation) emails saying they've changed banks and to update wire instructions. Your next routine payment goes to the attacker.
3. Invoice fraud
Attacker either intercepts a real invoice and changes routing info, OR generates a plausible-looking invoice for services that look familiar. AP processes it as routine.
4. M&A or confidential project
"This acquisition is confidential — don't loop in anyone else. Process this wire for due diligence/legal/closing costs. Hold the announcement until Monday."
What these have in common
- Urgency — pressure to skip your normal process
- Authority — claim to be from someone senior
- Secrecy — "don't tell anyone"
- Plausibility — the request looks like normal business
These work because finance teams are paid to be helpful and efficient. The fix isn't being less helpful — it's having verification steps that don't bend under pressure.
A real case
In 2024, a Hong Kong finance worker joined a video call with what looked like the CFO and other senior leaders. The CFO instructed them to wire $25M. The employee complied. Every "person" on the call was an AI deepfake. The control that would have caught it: independent verification through a known channel.
That's the entire course in one sentence.
Knowledge check
What do BEC, vendor bank changes, invoice fraud, and 'confidential M&A' wire requests have in common?