--- title: "MFA & Business Email Compromise | StartCloud" description: "How business email compromise redirects your payments, and how MFA plus a few supporting layers stops it. A plain-English guide for businesses." lang: en json-ld: | [ { "@context": "https://schema.org", "@type": [ "LocalBusiness", "ProfessionalService" ], "@id": "https://startcloud.au/#business", "name": "StartCloud", "legalName": "Start Technologies Pty Ltd", "alternateName": "StartCloud Australia", "identifier": { "@type": "PropertyValue", "propertyID": "ABN", "value": "17 676 121 449" }, "slogan": "Go Beyond", "description": "StartCloud is Perth's cybersecurity-first AI MSP: managed IT, Essential Eight security, Microsoft 365 and cloud, networking, and practical AI for Australian businesses with 5 to 50 staff.", "url": "https://startcloud.au", "logo": "https://startcloud.au/og-image.png", "image": "https://startcloud.au/og-image.png", "telephone": "+61862850001", "email": "web@startcloud.com.au", "priceRange": "$$", "currenciesAccepted": "AUD", "paymentAccepted": "Invoice", "foundingDate": "2023", "contactPoint": { "@type": "ContactPoint", "telephone": "+61862850001", "contactType": "customer service", "areaServed": "AU", "availableLanguage": "English" }, "address": { "@type": "PostalAddress", "streetAddress": "Ground Floor West, 6 Gibberd Road", "addressLocality": "Balcatta", "addressRegion": "WA", "postalCode": "6021", "addressCountry": "AU" }, "geo": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ], "opens": "07:00", "closes": "16:30", "description": "General support hours" }, { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday" ], "opens": "00:00", "closes": "23:59", "description": "Security Operations Centre (SOC) with 24/7/365 threat monitoring" } ], "areaServed": [ { "@type": "City", "name": "Perth" }, { "@type": "State", "name": "Western Australia" }, { "@type": "Country", "name": "Australia" } ], "serviceArea": { "@type": "GeoCircle", "geoMidpoint": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "geoRadius": "50000" }, "knowsAbout": [ "Cybersecurity", "Managed Security Services", "Essential Eight", "Microsoft 365", "Microsoft Azure", "IT Support", "Network Security", "Disaster Recovery", "Compliance Management", "Microsoft Copilot", "AI Readiness", "AI Governance", "AI Agent Development" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "IT and Cybersecurity Services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Cybersecurity Services", "url": "https://startcloud.au/cybersecurity" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed IT Services and Support", "url": "https://startcloud.au/technology" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Microsoft 365 and Cloud Solutions", "url": "https://startcloud.au/cloud" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed Networking", "url": "https://startcloud.au/networking" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI and Automation", "url": "https://startcloud.au/ai" } } ] }, "sameAs": [ "https://www.linkedin.com/company/startcloudau", "https://www.facebook.com/startcloudaus/", "https://www.cloudtango.net/providers/12375/startcloud", "https://clutch.co/profile/startcloud", "https://abr.business.gov.au/ABN/View?abn=17676121449", "https://www.yellowpages.com.au/balcatta-wa/bpp/startcloud-581735301", "https://www.truelocal.com.au/balcatta-wa/tlp/startcloud-581735301", "https://www.google.com/maps/place/StartCloud/@-31.8648767,115.8069889,739m/data=!3m2!1e3!4b1!4m6!3m5!1s0x2a32a5b5d9e864b5:0x9f02690968f0e50c!8m2!3d-31.8648813!4d115.8095638!16s%2Fg%2F11vzbgtytj" ] }, [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://startcloud.au/" }, { "@type": "ListItem", "position": 2, "name": "Resources", "item": "https://startcloud.au/resources" }, { "@type": "ListItem", "position": 3, "name": "MFA & Business Email Compromise", "item": "https://startcloud.au/resources/mfa-business-email-compromise" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is business email compromise?", "acceptedAnswer": { "@type": "Answer", "text": "Business email compromise (BEC) is a scam where an attacker either breaks into a real email account or convincingly impersonates someone, then uses that trust to redirect a payment or extract information. The classic version is a fake request to change a supplier's bank details, so your next payment goes to the attacker." } }, { "@type": "Question", "name": "Does MFA stop business email compromise?", "acceptedAnswer": { "@type": "Answer", "text": "MFA stops the most common route in: account takeover from a stolen password. It is the highest-value single control you can turn on. But it is not a complete answer on its own, because some BEC relies on impersonation rather than breaking into an account, so you also need email security and a payment-verification process." } }, { "@type": "Question", "name": "Is MFA enough on its own?", "acceptedAnswer": { "@type": "Answer", "text": "No. MFA blocks most account takeovers, but attackers have adapted with MFA-fatigue prompts and phishing kits that capture codes. Phishing-resistant MFA, conditional access, email filtering, and a simple rule to verify payment changes by phone close the remaining gaps." } }, { "@type": "Question", "name": "How do construction and trades businesses get targeted?", "acceptedAnswer": { "@type": "Answer", "text": "Construction is one of the most targeted industries for payment redirection, because large progress payments move between many parties. A compromised or spoofed email asking to update bank details can divert a payment worth hundreds of thousands. The same controls apply: MFA, email security, and verifying any change of details by phone." } } ] }, { "@context": "https://schema.org", "@type": "BlogPosting", "headline": "MFA and business email compromise: stopping the scam that redirects your payments", "description": "How business email compromise works, why email is the top attack vector, and how MFA and a few supporting layers stop most of it.", "author": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au" }, "publisher": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au", "logo": { "@type": "ImageObject", "url": "https://startcloud.au/startcloud-logo.png" } }, "datePublished": "2026-07-06", "dateModified": "2026-07-06", "image": "https://startcloud.au/og-image.png", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://startcloud.au/resources/mfa-business-email-compromise" } } ] ] --- [![StartCloud](/assets/StartCloud-Logo-ByZE1kzP.svg "StartCloud: Cybersecurity-First Managed IT Services Perth")](/ "StartCloud | Managed IT Services Perth") - Cybersecurity - AI Solutions - Cloud - Technology - Networking - Explore [Contact Us](/contact "Contact StartCloud, Perth IT Support") Open menu Overview Short Version What is BEC Why Email How MFA Helps Beyond MFA Verdict FAQ Related A plain-English deep dive into business email compromise (BEC) and multi-factor authentication (MFA) for small and mid-sized businesses. Explains how BEC scams redirect payments, why email is the number-one attack vector, how MFA stops most account takeovers, why MFA is not bulletproof on its own, and the additional layers (email security, conditional access, and verifying payment changes by phone) that close the gaps. Construction and trades businesses are a common target. [Home](/)[Resources](/resources)MFA & Email Compromise Security Essentials Guide The scam that redirects your payments # MFA and business email compromise Most serious attacks on small businesses start in the inbox, and the most expensive ones end with a payment going to the wrong bank account. Here is how business email compromise works, and why multi-factor authentication is the first thing to fix. StartCloud 6 July 2026 8 min read The short version ## The short version **Business email compromise is a scam that uses a real or faked email account to redirect a payment, usually by asking you to change a supplier's bank details.** It is one of the costliest attacks facing Australian businesses. **Multi-factor authentication is the single highest-value defence**, because it stops the account takeovers most of these scams rely on. Turn it on everywhere before anything else. MFA alone is not the whole answer. Pair it with email security, conditional access, and one simple rule: verify any change of bank details by phone, never by email. The scam ## What business email compromise actually looks like It rarely looks like a hack. It looks like a normal email. A supplier writes to say their bank details have changed, could you update them for the next invoice. The email is polite, on-brand, and often comes from a real account the attacker has quietly broken into, so it passes every sniff test. You update the details, pay the invoice, and the money is gone. Other versions impersonate the boss asking for an urgent transfer, or a staff member asking to change where their pay goes. The common thread is trust: the attacker does not break down the door, they get you to open it by looking like someone you already deal with. The front door ## Why email is the number-one way in Email is where your business runs and where your trust lives, which is exactly why attackers target it. Get into one mailbox and they can read months of conversations, learn how you talk, see who pays whom, and wait for the right moment to strike. That is far more valuable than a smash-and-grab. Most break-ins start with a stolen password, from a reused login, a phishing page, or a leak from some unrelated website. Which is why the first fix is the one that makes a stolen password useless on its own. The first fix ## How MFA stops most of it Multi-factor authentication means a password alone is not enough to sign in. You also need a second thing: a prompt on your phone, a code, or a security key. So when an attacker turns up with a stolen password, they hit a wall, because they do not have the second factor. It is unglamorous and it is the highest-value control you can turn on. On its own, MFA blocks the overwhelming majority of account takeovers, which is why it is one of the ACSC Essential Eight strategies and why insurers increasingly require it. If you do one thing after reading this, make it turning MFA on everywhere. The full picture ## MFA is not bulletproof, so add the layers that catch the rest Attackers have adapted with fatigue prompts and phishing kits that capture codes, and some BEC does not need to break into an account at all. These layers close the gaps MFA leaves. ### Multi-factor authentication The single highest-value control. Even if a password is stolen or guessed, MFA stops the attacker getting in. It blocks the vast majority of account takeovers on its own. ### Email security Filtering that flags impersonation, lookalike domains, and known-bad senders before they reach the inbox, so fewer convincing fakes ever land. ### Payment verification A simple rule that any change to bank details is confirmed by a phone call to a known number, never by email alone. This one process stops most redirected payments. ### Conditional access Rules that challenge or block risky sign-ins, for example from an unusual country or an unmanaged device, so a stolen password plus a stolen code still is not enough. Verdict ## The takeaway Business email compromise works because it targets trust, not technology, and the losses are real. The good news is that the defences are well understood and mostly straightforward. Turn on MFA everywhere, put proper email security in front of your inboxes, and make it a firm rule that any change to payment details is verified by a phone call to a known number. Those few controls stop the large majority of these scams. Getting them set up properly, and monitored so a compromise is caught early, is what our [managed security service](/cybersecurity/mssp) does day to day. Construction and trades businesses in particular, where big payments move between many parties, are worth a closer look at our [construction IT support](/it-support-construction-engineering-perth) page. [Explore managed cybersecurity](/cybersecurity-perth)[Try the free Essential Eight checklist](/cybersecurity/essential-eight-checklist) FAQ ## Common questions ### What is business email compromise? Business email compromise (BEC) is a scam where an attacker either breaks into a real email account or convincingly impersonates someone, then uses that trust to redirect a payment or extract information. The classic version is a fake request to change a supplier's bank details, so your next payment goes to the attacker. ### Does MFA stop business email compromise? MFA stops the most common route in: account takeover from a stolen password. It is the highest-value single control you can turn on. But it is not a complete answer on its own, because some BEC relies on impersonation rather than breaking into an account, so you also need email security and a payment-verification process. ### Is MFA enough on its own? No. MFA blocks most account takeovers, but attackers have adapted with MFA-fatigue prompts and phishing kits that capture codes. Phishing-resistant MFA, conditional access, email filtering, and a simple rule to verify payment changes by phone close the remaining gaps. ### How do construction and trades businesses get targeted? Construction is one of the most targeted industries for payment redirection, because large progress payments move between many parties. A compromised or spoofed email asking to update bank details can divert a payment worth hundreds of thousands. The same controls apply: MFA, email security, and verifying any change of details by phone. Keep reading ## Related pages [ Cybersecurity ### Cybersecurity Perth Managed security that puts MFA, email protection, and monitoring in place for you. Service ](/cybersecurity-perth)[ Industry ### Construction IT Support Why construction and engineering firms are prime targets for payment fraud, and how to stop it. Industry ](/it-support-construction-engineering-perth)[ Framework ### Essential Eight MFA is one of the eight. See the whole framework and how it reduces risk. Service ](/cybersecurity/essential-eight) ![StartCloud](/assets/StartCloud-Logo-ByZE1kzP.svg "StartCloud: Cybersecurity-First Managed IT Services Perth") Cybersecurity-led IT for Australian businesses. We manage security, compliance, and modern IT environments, so risk is governed, not guessed. Ground Floor West, 6 Gibberd Road, Balcatta WA 6021 [08 6285 0001](tel:+61862850001 "Call StartCloud on 08 6285 0001") Serving Perth businesses from Balcatta, Western Australia. ![Microsoft Solutions Partner - Modern Work](/assets/microsoft-solutions-partner-DqvNMv91.png "Microsoft Solutions Partner: Modern Work") ### Services - [Cybersecurity](/cybersecurity "Cybersecurity Services Perth | StartCloud") - [AI Solutions](/ai "AI & Automation Services Perth | StartCloud") - [Cloud](/cloud "Cloud Services Perth | StartCloud") - [Technology](/technology "IT Services and Support | StartCloud") - [Networking](/networking "Business Networking Perth | StartCloud") - [Packages](/packages "IT Support Packages Perth | StartCloud") ### Company - [About](/about "About StartCloud, Perth IT Support Team") - [Company Facts](/facts "StartCloud Company Facts | Perth Cybersecurity-First AI MSP") - [Resources](/resources "IT Resources & Guides | StartCloud Perth") - [Service Areas](/it-support-perth "IT Support Perth | StartCloud") - [Contact](/contact "Contact StartCloud, Perth IT Support") ### Locations - [All Service Areas](/locations "Perth IT Support Areas | StartCloud") - [IT Support Perth](/it-support-perth "IT Support Perth | StartCloud") - [Cybersecurity Perth](/cybersecurity-perth "Cybersecurity Perth | StartCloud") - [MSP Perth](/managed-service-provider-perth "Managed Service Provider Perth | StartCloud") - [Industries We Serve](/industries "IT Support by Industry Perth | StartCloud") © 2026 Start Technologies Pty Ltd trading as StartCloud. All rights reserved. ABN 17 676 121 449 [](https://www.linkedin.com/company/startcloudau "StartCloud on LinkedIn")[](https://www.facebook.com/startcloudaus/ "StartCloud on Facebook")[](https://www.google.com/maps/place/StartCloud/@-31.8648767,115.8069889,739m/data=!3m2!1e3!4b1!4m6!3m5!1s0x2a32a5b5d9e864b5:0x9f02690968f0e50c!8m2!3d-31.8648813!4d115.8095638!16s%2Fg%2F11vzbgtytj "StartCloud on Google") [Terms of Service](/terms-of-service "Terms of Service | StartCloud")| [Privacy Policy](/privacy-policy "Privacy Policy | StartCloud")| [Modern Slavery Policy](/modern-slavery-policy "Modern Slavery Policy | StartCloud")| [Cookie Policy](/cookie-policy "Cookie Policy | StartCloud") StartCloud Assistant Online G'day! 👋 I'm the StartCloud Assistant. How can I help you today? Tell me about your servicesBook a discovery callI need IT support Find Your Solution