A payment-change email can arrive from a real coworker's mailbox and still be fraudulent. Criminals may steal an already-authenticated session, then hide replies while they redirect a payment. Multi-factor authentication remains important, but your office also needs a reliable way to verify money requests.
For small law and CPA offices in Goshen and the Hudson Valley, a useful starting point is simple: verify payment changes independently, review mailbox activity and give staff a clear way to report anything unusual.
How email fraud works now, without a stolen password
Huntress illustrates the risk in an attack-chain demonstration involving a fictional finance employee. The example is not a reported breach at a named customer:
- She searches for ChatGPT, clicks a sponsored result and lands on an attacker-built custom GPT.
- It sends her to a fake "prove you're not a robot" page that tells her to paste a command into her computer. This trick is called ClickFix.
- The command lets the attacker grab her Microsoft 365 session cookie, the file that keeps her signed in to Outlook.
- With that cookie, the attacker is in her mailbox. No password and no MFA prompt.
- They create an inbox rule named ".." that archives anything mentioning a pending invoice, email the treasury team as her with a new routing number, and delete the evidence.
In Huntress's fictional example, the chain unfolds in about 24 hours.
Stolen sessions and hidden inbox rules, in plain words
A session cookie helps keep you signed in. If an attacker steals a usable cookie, they may be able to reuse that authenticated session. An inbox rule automatically sorts or handles mail. Criminals can abuse rules to conceal payment discussions and warning messages.
Sources: Microsoft: Respond to a compromised email account; Microsoft: Revoke user access
Fake meeting invites are the other front door
An unexpected meeting invitation can also lead to a fake sign-in page. Treat unfamiliar calendar attachments and join links with the same care as other unexpected email. Open your normal meeting app directly or verify with the sender through a known contact method.
Why CPA and law offices are a target
Small professional offices sit where money moves: refunds, payroll, vendor payments, retainers, settlements and closings.
The FBI's 2025 IC3 Annual Report counted 24,768 business email compromise (BEC) complaints in 2025, with reported losses of about $3.05 billion.
Tax-season pressure and busy closing schedules leave little time to inspect every message. Set your verification procedure before the next rush, and make sure it still works when the usual approver is away.
Six controls that help reduce business email compromise
1. Adopt a callback verification policy for every wire transfer and bank change
Any new or changed bank details get a phone call to a number you already have on file, never one from the email, invoice or voicemail. In the Huntress example, the request came from a real coworker's real mailbox, so "it came from someone we know" isn't proof. Add a second person's sign-off for wires above an amount you choose, and write the rule down so nobody has to decide under pressure.
Sources: FBI: Business Email Compromise
2. Run a monthly mailbox-rule check
Once a month, check the inbox rules and forwarding on every mailbox that touches money or client files. Look for:
- rules you don't recognize, especially ones with blank or odd names like "." or ".."
- rules that move, archive, delete or mark as read messages containing words like "invoice," "payment," "wire" or a vendor's name
- automatic forwarding to an outside address
- apps or add-ons with mailbox access that nobody remembers approving
Ask your IT provider to review rules and forwarding centrally, including hidden rules that may not appear in the ordinary mailbox view, and to configure alerts for suspicious changes. A monthly review is a useful routine, not a substitute for responding immediately to an alert.
3. Make a stolen session less useful
Keep MFA enabled. Ask your IT provider to pair phishing-resistant sign-in with device and session controls appropriate to your email system. A compromised device or stolen session needs more than a password reset. For a small office:
- use phishing-resistant sign-in (passkeys or security keys) where your plan supports it, starting with whoever approves payments
- ask your IT provider about shorter sign-in sessions on devices the office doesn't manage
- if anything looks off, contact your IT provider immediately to contain access and revoke sessions; the timing and effect depend on the application
Sources: Microsoft: Revoke user access; Microsoft: Protect identities and secrets
4. Nobody pastes commands from a web page, and AI tools come from an approved list
A request to paste a command into Terminal, PowerShell or Run to prove you're human is a warning sign. Staff should stop and call their IT contact. Keep approved AI tools and their official entry points easy to find.
5. Treat surprise calendar invites like any other email
An invite is just another email. If one arrives unexpectedly or asks you to sign in to "view" or "join," don't sign in from the link. Open the app you normally use, or check with the sender by phone.
6. Clean up old accounts, shared passwords and unused apps
Remove or disable accounts that former staff no longer need, review administrator privileges and remove unused applications with mailbox access. Replace shared sign-ins with individual accounts where possible. These housekeeping steps make it easier to identify unusual activity and limit unnecessary access.
If you think a mailbox has been taken over
Act immediately. Call your IT provider through a known number so they can block compromised access, revoke sessions, reset credentials and investigate the affected device. Preserve suspicious messages and logs; have the investigator document unauthorized rules and forwarding before removing them. Review added MFA methods, app permissions and sent or deleted mail as well. If money moved, call your bank immediately to request a recall and report the fraud at https://www.ic3.gov. Recovery is not guaranteed. If client information may be involved, contact your attorney about notification obligations.
Sources: Microsoft: Respond to a compromised email account; Microsoft: Revoke user access; FBI: Business Email Compromise
Write it down
Add the callback procedure and mailbox-review responsibilities to your written security procedures and staff training. Tax practices can use IRS Publication 5708 to help develop a written information security plan (WISP). A couple of procedures alone do not make a complete WISP.
Sources: IRS Publication 5708: Creating a Written Information Security Plan
FAQ
We already use MFA. Are we covered?
Keep MFA, preferably phishing-resistant methods where supported. It does not eliminate stolen-session risk, so payment verification and device security still matter.
What is a callback verification policy for wire transfers?
A written rule that new or changed payment details are confirmed by calling a number already on file, with a second sign-off for larger amounts.
How often should we check mailbox rules?
A monthly review is a practical starting point. Investigate suspicious sign-ins or rule changes immediately rather than waiting for that review.
We're a three-person office with no IT department. Where do we start?
Start the callback rule today, then do your first mailbox-rule check this month.
This post is general information, not legal advice, and not a guarantee that any step will prevent fraud. Talk with a qualified attorney about your firm's specific obligations.
Next steps
- Have questions about your office's email controls? Call FIX256 at 845-210-1677.
Want a clearer view of your office's IT? See FIX256's $299 Remote IT Assessment: https://fix256.com/assessment. It is fully remote for organizations with up to 25 users and includes written findings, prioritized next steps and a 30-minute review call. The $299 rate is valid for 30 days after your intro call; scope and timing are agreed before work. Penetration testing, compliance certification, remediation and onsite work are excluded. The introductory call and paid assessment are separate.
FIX256 LLC is a managed IT, cybersecurity and AI automation firm in Goshen, NY, working with small law, CPA and professional offices.