These messages work because a successful click can redirect money or expose credentials with little visible friction. Attackers often start with spoofed or compromised email, then push the victim to a fake login page or payment change request. Once the fraud is underway, the organisation may not notice until funds have already moved.
Why these phishing attempts work so well
Account-switching and credential-submission phishes are effective because they collapse the victim’s decision window. The user is pushed from an inbox message into a fake but familiar workflow, where a login prompt or payment-detail change feels routine enough to bypass hesitation. That is why the Ultimate Guide to NHIs is useful context here: once credentials are captured, the attacker can use them as a live access path rather than just stolen data.
These lures also exploit trust in process, not just trust in sender identity. A spoofed or compromised mailbox, a well-timed “updated payment instructions” message, or a fake sign-in page can each create enough realism to make the request feel normal. The risk rises sharply when the request aligns with an expected business event, because the victim is less likely to challenge the change.
One relevant signal is that secret sprawl and long-lived credentials create durable blast radius: if a submitted password, token, or code is still valid after the phish, the attacker does not need a second opportunity. In practice, the fraud is often not limited to one inbox compromise, it becomes a gateway to payment redirection, account takeover, or secondary impersonation.
Why the fraud impact escalates so quickly
Once an attacker has working credentials or can alter account details, the fraud path becomes operational rather than speculative. Funds may be redirected through legitimate payment channels, invoice records may be updated, or an account recovery flow may be used to lock out the real user. The organisation can remain blind until a reconciliation, customer complaint, or suspicious transfer finally exposes the change.
This is also why credential reuse matters so much. A phish does not need to compromise the most important account on the first try. It only needs one valid set of credentials or one successful account-switching step to open a path into finance, admin, support, or cloud services where the attacker can pivot. In that sense, the email is just the entry mechanism, the fraud is created by the authority that the captured credentials unlock.
- Account-switching requests are especially dangerous when the target can approve payments, change beneficiary details, or reset access.
- Credential-submission requests are especially dangerous when the same secret can be reused across email, SaaS, or internal portals.
- Any delay in detection increases loss because legitimate-looking actions are harder to unwind after they are executed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Secrets and Credential Management | Captured credentials and tokens are the direct fraud enabler in credential-submission phishes. |
| NHI-03 — Excessive Permissions and Privilege | Phish impact grows when a stolen login can change payment or account settings. | |
| Recommendation — Rotate and tightly govern credentials that can be harvested through phishing. Restrict accounts so a single compromise cannot alter high-value workflows. | ||
| CIS Controls v8 | 6 — Access Control Management | Least-privilege and account governance reduce what a phished credential can do. |
| 8 — Audit Log Management | Rapid fraud detection depends on reliable logs for account changes and payment updates. | |
| Recommendation — Limit account rights to the minimum needed for the business task. Log account changes and value-moving actions with alertable audit trails. | ||
| NIST CSF 2.0 | PR.AA — Identity Management, Authentication, and Access Control | The scenario centers on authentication abuse and access control failure. |
| DE.CM — Continuous Monitoring | Fraud often persists until monitoring detects unusual account or transfer activity. | |
| Recommendation — Strengthen authentication and access controls for payment and account-change paths. Monitor for anomalous login, payment, and recovery events continuously. | ||
| MITRE ATT&CK | T1566 — Phishing | The attack starts with a phishing lure used to obtain credentials or redirect action. |
| T1078 — Valid Accounts | Stolen credentials let attackers operate through legitimate access paths. | |
| Recommendation — Map suspicious messages to phishing detections and user-reporting playbooks. Hunt for abuse of valid accounts after credential submission incidents. | ||
| NIST SP 800-63 | 6 — Authenticator and Lifecycle Requirements | Phishing risk falls when authenticators and recovery paths are harder to abuse. |
| Recommendation — Use stronger authenticators and tighten recovery flows for sensitive accounts. | ||
Practitioner Guidance
What to verify: Treat any request to change payment details, switch accounts, or re-enter credentials as a high-risk event unless it is independently validated through a separate channel. The control point is not the email itself, it is whether the request can be confirmed out-of-band before any money movement or credential use is allowed.
What to prioritize: Focus first on the workflows that can move value or alter access with minimal friction, because those are the paths attackers prefer. If a single captured login can reach finance, procurement, identity recovery, or admin approvals, that account deserves tighter challenge, monitoring, and segregation than a normal user mailbox.
Common mistake: Teams often tune controls for obvious malware and miss fraudulent workflow changes that look “business normal.” If the process allows one click, one password, or one approval to change destination accounts, the question is not whether the message looks convincing, it is whether the process is resilient to impersonation.
Practitioner takeaway: The highest-risk phish is the one that turns a trusted process into an authorised-looking transaction before anyone realises the sender, page, or request was fake.
Related resources from NHI Mgmt Group
- Why do breaches involving learning platforms create such a high risk of spear phishing and account takeover?
- Why do phishing and credential theft create such high risk for banks and insurers?
- Why do phishing and valid-account attacks create such high breach risk in environments with otherwise secure systems?
- Why does SIM swapping create such a high account takeover risk for authentication and fraud teams?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
