Janet built her commercial cleaning business the way most small business owners build theirs. One client at a time. One referral at a time. Years of showing up on time, doing the work well, and earning the kind of trust that does not come from advertising. It comes from reliability.
By the time her email was compromised, she had a staff of twelve, a roster of steady commercial clients, and a reputation she had spent years protecting.
She lost a portion of that in three weeks. And she never heard an alarm.
The Attack Nobody Saw Coming
Business Email Compromise is not like ransomware. There is no dramatic moment where everything stops and a threatening message appears on your screen. There is no obvious sign that anything has changed.
A criminal gains access to your email account through a stolen password, a phishing link, or a vulnerability in your email platform. Then they do something that makes this attack uniquely dangerous. They wait.
They read your emails. They study your communication patterns. They learn who your clients are, who your vendors are, how you send invoices, how payments are typically processed, and what language you use when you write to people you trust. They build a complete picture of your business relationships from the inside, using your own inbox as their research tool.
Then, when the moment is right, they act.
In Janet's case, the criminal who had access to her account began intercepting communications between Janet and several of her clients. When invoices went out, the payment instructions that arrived with them were not Janet's actual banking information. They were the criminal's. The emails looked exactly like Janet's emails because they were sent from Janet's email address, written in Janet's voice, following Janet's normal billing schedule.
Three weeks passed. Payments came in. None of them reached Janet.
Three Weeks of Normal
This is the detail that stays with me every time I share this story.
For three weeks, Janet went about her business. She managed her team. She served her clients. She communicated with vendors. Everything felt completely normal because from her perspective, it was. Her email was working. Her clients were responding. She had no indication whatsoever that anything was wrong.
What she did not know was that someone else was reading every email she sent and received. That her client relationships were being quietly exploited. That money her clients genuinely paid, money owed to her for work her team had done, was flowing to a criminal account.
There were no sirens. No warnings. Just loss.
The damage totaled $18,000 before anyone caught it. A client called to ask about a discrepancy in their payment records. That phone call was the first indication Janet had that something was wrong.
What Came After
The $18,000 was painful. What followed was harder.
Janet had to contact every client and explain what had happened. She had to acknowledge that her email system had been compromised and that communications they believed were private had been read by a criminal. She had to ask whether any of them had received fraudulent payment instructions, and if so, whether they had acted on them.
That series of conversations took weeks. Some clients were understanding. Some were not. The trust she had built over years of showing up and doing the work right was suddenly, through no fault of her own, in question. Several clients required reassurance that her systems were now secure before they would continue working with her. One or two did not come back at all.
The financial loss was recoverable. The reputational work took months.
And the question that came up in almost every difficult conversation was the same one: how did this happen without anyone noticing?
How It Happened Without Anyone Noticing
Business Email Compromise exploits the one security assumption almost every small business makes: that because an email comes from a familiar address, it can be trusted.
Janet's clients did not question the payment instructions they received because the emails looked exactly right. The sender's name was correct. The email address was correct. The tone and formatting matched every previous communication they had received from Janet. They had no reason to suspect anything was wrong because everything appeared completely normal.
This is what makes Business Email Compromise so effective and so devastating. It does not rely on tricking someone into clicking a suspicious link or opening a dangerous attachment. It relies on trust. And in a business built on relationships, trust is everywhere.
The criminal did not break into Janet's office. They did not need to. They had full access to her most important business tool, her email, and they used it the way she would have used it. Professionally, patiently, and profitably.
What Would Have Stopped It
Three specific controls would have prevented Janet's situation entirely.
Multi-factor authentication on her email account
When an unauthorized user attempted to log into Janet's email from an unfamiliar device or location, a properly configured multi-factor authentication system would have blocked that access immediately. The criminal would have needed more than just her password. They would have needed the second verification code sent to her phone. They did not have that, and they never would.
Email security monitoring
A properly configured email security system monitors login activity and flags access from unfamiliar locations, devices, or unusual times. Janet's email was accessed repeatedly over three weeks from a location that had nothing to do with her business. That pattern, seen by a monitoring system, would have triggered an alert long before any financial damage occurred.
A verification protocol for payment instructions
For any email that includes payment information, a simple rule changes everything: verify the request through a separate channel before acting on it. A quick phone call. A text message. Any confirmation that does not travel through the same email channel that could be compromised. This one practice, adopted across Janet's client base, would have caught the fraudulent instructions on the first attempt.
None of these are expensive. None of them require technical expertise to implement. Each of them was absent from Janet's operation when the attack happened.
The Business Owner This Happens To
Janet is not the only one. Business Email Compromise is one of the most financially damaging forms of cybercrime targeting small businesses today, precisely because it is invisible, patient, and exploits the relationships business owners have worked hardest to build.
The business owners most at risk are the ones who handle payment communications, client relationships, and vendor coordination through email, which describes the majority of small businesses operating today. Retail businesses. Service companies. Cleaning firms, catering companies, consulting practices, property managers, and anyone else whose email inbox is the operational center of their client relationships.
If your business runs on email, your email is worth protecting.
What Janet Knows Now
When Janet talks about what happened, she does not talk about the $18,000. She talks about the phone calls. The conversations with clients she had known for years, explaining that their trust had been exploited through her systems. The months of extra effort it took to rebuild something that had taken years to create in the first place.
She now has multi-factor authentication on every business account. She has email security monitoring actively running. She has a simple payment verification protocol her entire team follows without exception. And she has something she did not have before: the certainty that if someone tries to access her systems without authorization, it will be caught.
That certainty, she says, is worth more than the $18,000 ever was.
You Should Not Have to Learn This the Hard Way
The right time to find out what is protecting your business is before something goes wrong. Not during a difficult phone call with a client asking about a payment discrepancy. Not while reviewing bank records and realizing that three weeks of revenue went somewhere else.
Our free Business Security Assessment covers your email security, your authentication settings, your monitoring, and every other layer of your current protection. It takes less than 10 minutes. It gives you a clear, honest picture of where you are today and what it would take to make sure Janet's story never becomes yours.
Not sure where your business actually stands?
Take our free Business Security Assessment. In under 10 minutes, you will know exactly where your gaps are and what it would take to close them.
Get My Free Security Assessment
