VETERAN-OWNED · NEBRASKA-BASED
A vendor calls your office in Lincoln to ask why nobody answered their last three emails. Your bookkeeper never saw them. That gap is often the first visible sign that a finance mailbox has been taken over.
This post is about the signs that show up before money moves. It is for small finance and accounts payable teams in Lincoln, Omaha, and across Nebraska.
Our business email compromise guide covers the whole family of these scams. The posts on vendor payment-change fraud and CEO fraud wire requests cover what the attacker asks for once they are in.
Why attackers want the finance mailbox
A finance mailbox holds vendor threads, invoice dates, bank details, and the names of the people who approve payments.
Once an attacker can read it, they can wait for a large invoice and slip into the thread at the right moment. Their message arrives from a trusted address, in the right tone, with the right invoice number.
They often get in with a stolen password. They may also trick someone into approving a sign-in prompt or typing a code into a look-alike login page.
Sign 1: Inbox rules nobody remembers making
Attackers often add a rule so the mailbox owner stops seeing certain messages.
The rule might move anything with "invoice," "payment," or a vendor's name into a folder nobody opens. It might mark those messages as read, delete them, or forward a copy outside the company.
Our post on the mailbox rule finance never sees goes deeper on forwarding rules and who should be allowed to create them.
Sign 2: Forwarding to an outside address
Microsoft 365 and Google Workspace both let a mailbox forward mail automatically.
A forwarding address the company does not own is worth an immediate question. So is a forwarding setting that the mailbox owner did not turn on.
Sign 3: Sign-ins that do not fit
Sign-in history shows when and where an account was used.
Look for sign-ins from another state or country, from a device type the person does not use, or at hours when the office is closed. Two sign-ins far apart within a short window are a strong warning.
An unexpected MFA prompt on someone's phone counts too. Ask staff to report a prompt they did not start, and never to approve it.
Sign 4: Replies that go missing
Vendors and clients say they replied, but nothing is in the inbox.
A bookkeeper finds messages in Deleted Items that they never opened. A thread seems to skip a step, as if someone else answered first.
Each of these points to someone else working in the mailbox, or to a rule hiding mail from the owner.
Sign 5: Sent mail nobody remembers sending
Open Sent Items and look for payment, banking, or W-9 messages the owner does not recognize.
Attackers may delete their sent messages afterward, so also check whether Sent or Deleted Items look emptier than usual for a busy week.
Sign 6: A bank-change request from inside the company
A coworker emails AP to say a vendor changed banks, with the new details attached. The request comes from the coworker's own address.
That is exactly what a compromised internal mailbox looks like. Confirm it in person or on a number you already had, with the coworker and with the vendor, before anyone updates the vendor record.
Sign 7: New apps or delegates on the mailbox
Some attackers keep access by granting an app permission to read mail. Others add a delegate who can read the mailbox or send as the owner.
A password reset does not remove either one. Your email admin can review connected apps and mailbox permissions and remove anything nobody recognizes.
A weekly check for a small finance team
Pick one day a week and spend fifteen minutes on each finance mailbox.
- Review inbox rules and filters for anything that forwards, deletes, moves, or marks mail as read.
- Check forwarding settings for any address outside the company.
- Look at recent sign-in activity, or ask your email admin to send a short summary.
- Scan Sent Items and Deleted Items for payment messages nobody remembers.
- Confirm any bank-change request on a known number before the vendor record changes.
- Ask the team whether anyone saw an MFA prompt they did not start.
In Microsoft 365, rules and forwarding sit in Outlook settings, and sign-in history sits in the admin portal. In Google Workspace, filters and forwarding sit in Gmail settings, and recent activity is listed in the account's security page.
Write the result down each week. A short log makes it easier to spot when something changes.
Controls that make takeover harder
- Turn on MFA for every mailbox, starting with finance, owners, and anyone who approves payments.
- Block automatic forwarding to outside addresses, or require approval for it.
- Limit who can grant apps access to company mail.
- Alert on new inbox rules that forward or delete mail.
- Keep a written call-back and dual approval rule for any new payee or bank change.
Our email security and Microsoft 365 management pages describe how we set these up. Lincoln businesses can also read about cybersecurity services in Lincoln.
First steps if something looks off
Pause any payment that is in flight from that mailbox until it is verified on a known number.
Tell whoever runs your email before you delete rules or change settings. The rule, the sign-in history, and the messages are evidence, and your bank or insurer may ask for them.
Reset the password, sign the account out of every session, and confirm MFA is set up correctly. Then review apps and delegates so the attacker cannot come back another way.
If money already moved, call your bank's fraud line right away and file a report at ic3.gov. Our business email compromise first actions guide and the post on what to do in the first hour after a phishing click walk through the rest.
Lincoln, Omaha, and beyond
SAINT works with offices in Lincoln and Omaha, with businesses across Nebraska, and with teams elsewhere in the Midwest on the email and identity controls in this post. More on how we work is on our cybersecurity page.
When did someone last look at the inbox rules on your bookkeeper's mailbox?