What Is Diversion Theft? Definition & Examples

Diversion theft is the redirection of a legitimate payment, shipment, or communication to an attacker-controlled destination. In identity security, it often begins with account takeover, email compromise, or NHI abuse, then uses altered instructions, permissions, or routing data to steal funds, goods, or information without immediate detection.

How Diversion Theft Works

Diversion theft is not just “stolen funds” or “stolen goods”, it is a redirection crime. The attacker changes where a legitimate transfer, delivery, or message is sent, then relies on normal business processes to carry the diversion through.

That redirection can happen at many points in the chain: payment instructions, shipment labels, account details, approval workflows, inboxes, or shared documents. The key feature is that the victim believes they are executing a valid instruction while the attacker has quietly replaced the destination.

Why Diversion Theft Is Effective

This technique works because it exploits trust in established routes and familiar recipients. A bank transfer, vendor payment, courier shipment, or internal communication usually moves faster when it appears routine, so attackers try to make the altered instruction look ordinary enough to pass initial checks.

In practice, the attacker may already have access to a mailbox, workflow tool, or business account before the diversion begins. That means the fraud can be staged from inside a trusted channel rather than from an obvious external source.

Identity and Access Pathways Behind the Attack

In many cases, diversion theft depends on identity compromise rather than on technical exploitation alone. Account takeover, email compromise, token abuse, or misuse of a non-human identity can let an attacker alter routing data, payment details, or delivery instructions without triggering immediate suspicion.

This is why the same control weaknesses that enable unauthorized access often also enable redirection. Stronger authentication, tighter authorization, and better control of credentials and sessions reduce the chance that an attacker can rewrite the trusted path.

Detecting and Limiting Diversion

Organisations reduce exposure by treating destination changes as high-risk events. Changes to bank details, shipping addresses, approval chains, forwarding rules, or payment recipients should be visible, reviewable, and easy to verify through an independent channel.

Detection is strongest when teams compare the instruction source, the destination change, and the transaction context together. A legitimate request sent through an unusual mailbox, a last-minute destination update, or an account acting outside its normal pattern are all signals that deserve review.

Where possible, RFC 9700: Best Current Practice for OAuth 2.0 Security is useful because diversion often follows token theft or weak sender-constrained access, which can let an attacker act inside trusted workflows. MITRE ATT&CK Enterprise Matrix also helps defenders map the access abuse, persistence, and credential-driven steps that commonly precede diversion behaviour. NIST SP 800-53 Rev 5 Security and Privacy Controls provides a broader control lens for access control, authentication, audit, and configuration discipline that limit the attack surface.

Risk and Threat Considerations

Diversion theft is dangerous because it converts ordinary business trust into an attack path. The loss may be financial, but it can also involve goods, sensitive information, or operational disruption when a legitimate process is quietly steered to the wrong destination.

Failure mechanism: The attacker compromises an account, messaging channel, or workflow control point, then modifies destination data or delivery instructions before the organisation verifies the change independently.

Impact: Funds, shipments, or communications are redirected to the attacker, often with delayed detection and with added recovery cost because the action appears to have been authorised through a normal process.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1114 — Email Collection	Diversion theft often begins with mailbox compromise or message abuse.
Recommendation — Map mailbox abuse to T1114 and monitor for unauthorized message access and forwarding changes.
NIST SP 800-53 Rev 5	AC-2 — Account Management	Controls account ownership and changes that can enable redirection fraud.
	AU-2 — Audit Events	Logging destination edits and approval actions supports detection of diversion activity.
	IA-5 — Authenticator Management	Credential lifecycle control reduces account takeover used to enable diversion theft.
Recommendation — Enforce AC-2 to review, approve, and revoke accounts that can alter destinations or instructions. Define AU-2 events for recipient changes, forwarding rules, and payment instruction updates. Apply IA-5 to rotate and protect authenticators that can access payment or routing systems.

Practitioner Guidance

Why practitioners should care: Diversion theft is a governance problem as much as a fraud problem, because it usually succeeds when ownership of destination changes is unclear. If no one is accountable for verifying changes to payment, shipment, or routing data, the attacker only needs one weak handoff.

What to watch for: Treat unexpected destination changes, new forwarding rules, altered vendor details, and out-of-band approval requests as red flags. These signals matter most when they appear alongside recent login anomalies, mailbox access, or other signs of compromised identity.

Practitioner takeaway: The safest pattern is to separate “request received” from “destination verified”, then require an independent check before any high-value transfer or reroute is completed.

Diversion Theft