Business Email Compromise: Why MFA Alone Is No Longer Enough
One business we worked with lost $200,000 to an email compromise. Multi-factor authentication was switched on. The attackers had been inside the mailbox for five months, and nobody detected them for two.
MFA did its job. It stopped the password being enough. What it could not stop was what happened after a legitimate login.
How Attackers Get Past MFA
When you sign in successfully, the system issues a session token so you are not challenged again on every click. That token is what keeps you logged in.
If an attacker obtains that token, they inherit your authenticated session. No second factor is requested, because as far as the system is concerned, authentication already happened and this is the same session continuing.
Tokens get stolen in two main ways. A convincing fake login page that relays your credentials and your MFA code to the real service in real time, capturing the resulting session. Or malware on the device that lifts the token directly from the browser.
Neither requires breaking MFA. Both go around it.
What Happens Next Is Patience
The part that surprises people is how long attackers wait.
They do not act immediately, because acting raises alarms. Instead they read. They learn who approves payments, how invoices are worded, which suppliers are active, when the finance person takes leave, and how your organisation talks to itself.
Often they create a quiet mailbox rule that moves certain messages to a folder nobody checks, so that replies to their eventual fraud never reach the real recipient.
In the case above, five months of this preceded anything visible. Two months passed between the fraud and its discovery.
Why It Is Usually Found Late
Nothing looks wrong. The user is not locked out. No ransom note appears. Email continues working normally.
The compromise surfaces when a supplier asks about an unpaid invoice that was in fact paid, into the wrong account. By then the money has moved several times.
What Actually Helps
Keep MFA. It remains the highest-value control available, and the alternative is worse. But recognise what it does: it protects the login, not the session.
The controls that address what MFA does not:
- Monitoring that watches session behaviour, not just logins. A mailbox being read from an unusual location, or at unusual hours, is the signal.
- Alerting on mailbox rule changes. The quiet rule that hides replies is one of the most reliable indicators of compromise and most businesses never see it.
- Conditional access policies that restrict where sessions are valid and shorten their lifetime for high-risk accounts.
- Out-of-band verification of payment changes. Any request to change bank details gets confirmed by phone, on a number you already had, never one in the email.
- Global administrator accounts with no mailbox, so a phished user cannot become a tenant compromise.
That payment verification rule is the cheapest control on this list and would have stopped the loss described above.
The Point
MFA is necessary. It is not a finished security posture, and treating it as one is how businesses with good intentions still lose six figures.
The question worth asking is not whether you have MFA. It is who would notice if someone were reading your email right now.
MFA Is Still Essential. It Just Cannot Stand Alone.
If your business has enabled MFA, that was the right decision. Keep it enabled. The lesson from modern business email compromise is not that MFA has stopped working. The lesson is that attackers have adapted.
Businesses now need multiple layers around email, including better link protection, suspicious login monitoring, inbox rule alerts, device controls, and strong payment verification procedures.
At Digital Sky Solutions, we help businesses in Victoria, Vancouver, and across British Columbia strengthen Microsoft 365 and email security through our Managed IT and Cybersecurity services.
If your current email security strategy is mainly "we have MFA, so we're covered," it is worth reviewing. When a compromised email account can redirect a six-figure payment without anyone noticing, finding out weeks later is far too late.
Related Posts:
- How to Protect Microsoft 365 Accounts with Multi-Factor Authentication
- Why Password Security Still Fails Most Businesses
- Is Your Business Leaking Data Without You Knowing?
