Security teams should treat these threats as an identity and workflow problem, not only an email filter problem. Reduce blast radius with strong verification for payment and payroll changes, tighter approvals, user awareness for social engineering, and monitoring for anomalous communication patterns. The goal is to make impersonation harder to convert into an action that moves money or changes sensitive records.
Why Human-Centred Fraud Succeeds Even When Mail Security Is Strong
lateral phishing, invoice fraud, and payroll diversion work because they exploit trust, urgency, and routine approval paths. The attack does not need to defeat every technical control if it can persuade one person to approve a change, share a credential, or treat an impostor as legitimate. MITRE ATT&CK documents how adversaries use phishing and credential access patterns to move from initial deception to broader compromise, which is why identity-aware verification matters alongside email security.
Security teams often overestimate the protection provided by filtering alone. A message can be delivered, read, and acted on even when the message itself is not technically malicious by signature or attachment. Once an attacker is inside a familiar thread or payment workflow, the organisation’s own process becomes the attack surface. In practice, many security teams discover the weakness only after a legitimate-looking request has already been approved and the financial or record change is difficult to unwind.
How These Attacks Move From Conversation to Money Movement
These frauds usually follow a simple pattern: the attacker gains a foothold in a mailbox, impersonates a trusted colleague or supplier, and then pushes a time-sensitive request through a business process that was designed for speed, not verification. Lateral phishing uses an internal account or a convincing impersonation to reach additional employees. Invoice fraud targets accounts payable by substituting bank details or redirecting a payment instruction. Payroll diversion targets HR or payroll teams by changing the destination account for salary payments.
The key failure is not only deception, but workflow trust. If an approval chain accepts a request because it appears to come from a known sender, the organisation has effectively made email identity part of the control. That is fragile because display names, thread hijacking, and compromised accounts can all create false legitimacy. Stronger practice separates communication from authorisation: a request may arrive by email, but the change itself is confirmed through an independent channel or a protected system record. For organisations that process high-value payments, this is a control-design issue as much as a user-training issue.
Useful controls usually combine:
- step-up verification for bank detail changes, urgent payments, and payroll amendments
- dual approval for sensitive financial or HR changes
- out-of-band confirmation with a known contact path, not a reply in the same thread
- logging and alerting for unusual changes to supplier, payee, or employee records
- training that teaches staff to recognise urgency, secrecy, and authority pressure
NIST guidance on control families for access, auditing, and incident response is especially relevant here because the problem is detecting and constraining fraudulent action, not merely stopping email delivery. Where the workflow itself has no independent verification, the control breaks down at the point of approval rather than at the point of receipt.
Where Verification Breaks Down in Real Organisations
Tighter verification often increases friction, which means organisations have to balance fraud resistance against operational delay. That tradeoff is real, especially where procurement, HR, and finance teams handle legitimate urgent requests every day. The right response is not to remove friction everywhere, but to apply it where the consequence of a bad decision is highest.
There are also common edge cases. A supplier may legitimately change banking details. An executive may legitimately need a same-day transfer. A payroll correction may need to happen quickly. Those cases should not bypass control by default; they should trigger a higher-trust process with stronger proof of identity, pre-defined exception handling, and post-action review. Guidance versus consensus matters here: some organisations still rely on “recognised sender” checks, but there is no consensus that sender recognition alone is sufficient as a control for payment or payroll changes.
Teams should also remember that compromise can begin with one mailbox and end in many workflows. Once an attacker can observe internal language, naming conventions, or approval habits, their messages become harder to distinguish from normal business traffic. The practical limit of any awareness programme is that it cannot compensate for a process that allows a single persuasive message to move money. For that reason, the best defences are layered and deliberately inconvenient at the exact point where fraud converts into action.
Risk and Threat Considerations
These attacks create direct exposure to financial loss, unauthorised record changes, and downstream trust erosion across finance and HR processes. They are attractive because the attacker does not need to exploit a software vulnerability if they can abuse human judgement inside a legitimate workflow.
Failure mechanism: The attacker leverages impersonation, thread hijacking, or compromised messaging to obtain approval for a payment, supplier change, or payroll diversion. The control failure usually occurs when the organisation treats a communication channel as proof of identity or authorisation.
Impact: Money can be redirected, employee pay can be diverted, supplier records can be corrupted, and recovery becomes difficult once a legitimate system record has been updated.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | Lateral phishing and impersonation use phishing tradecraft to gain trust or access. |
| Recommendation — Map suspicious message patterns to T1566 and hunt for account compromise or thread hijacking. | ||
| CIS Controls v8 | 6 — Access Control Management | Payment and payroll diversion depend on weak approval and access-change controls. |
| 8 — Audit Log Management | These frauds are often caught through anomalous changes to records and communications. | |
| Recommendation — Enforce least privilege and dual approval for payee and payroll record changes. Retain and review logs for bank detail, payroll, and supplier record changes. | ||
| NIST CSF 2.0 | PR.AC — Identity Management, Authentication and Access Control | The issue is whether identity proof is strong enough before sensitive workflow actions proceed. |
| DE.CM — Security Continuous Monitoring | Detection of anomalous communication and record-change patterns is central to limiting impact. | |
| RS.AN — Analysis | Confirmed fraud needs fast triage to contain damage and preserve evidence. | |
| Recommendation — Apply PR.AC controls to separate message receipt from authorisation of financial changes. Monitor for unusual approvals, recipient changes, and high-risk workflow activity. Use RS.AN to triage suspicious payment changes and preserve evidence for investigation. | ||
Practitioner Guidance
What to prioritise: Protect the workflows that can move money or change payee data first. If a request can alter bank details, payment instructions, or payroll destination accounts, it deserves stronger verification than routine business correspondence.
What to verify: Confirm that approvals are not satisfiable from the same channel that delivered the request. The deciding question is whether a compromised mailbox or spoofed thread can still complete the change without an independent check.
Common mistake: Treating awareness training as the primary control. Training helps, but it is weakest where the request looks normal, the sender is familiar, and the process encourages speed over scrutiny.
What good looks like: Sensitive changes require a separate trust step, exception handling is documented, and finance or HR teams can show that suspicious requests were paused, challenged, or escalated before execution.
Practitioner takeaway: The most resilient programmes assume that at least one message will look convincing, and they design business processes so that persuasion alone cannot authorise a high-impact change.
Related resources from NHI Mgmt Group
- How should security teams reduce the impact of phishing and BEC on human users?
- How should healthcare security teams reduce the impact of phishing before attackers move laterally?
- How should security teams reduce the impact of a compromised non-human identity?
- How should security teams reduce fraud when attackers use deepfakes and synthetic identities?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 7, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
