Business email compromise: MFA isn't enough

Last reviewed: 31 October 2026

Yes, phishing can get past multi-factor authentication (MFA), the extra sign-in step such as a phone approval or a code. A fake sign-in page passes your password to the real service, shows you the real service’s MFA prompt, and keeps the signed-in session once you approve. It is one route into business email compromise in Australia, where combined reports of payment redirection scams, which include more than compromised mailboxes, show $166.8 million in losses for calendar 2025.

Picture a 50-person Australian business (a composite, not a client). The accounts lead gets a message from a long-standing supplier asking her to sign a revised agreement. The sender address is right and the thread is real.

She clicks and lands on what looks like her usual sign-in page. She types her password and approves the prompt on her phone, and the attacker is in. She did nothing careless: every check she could see said the message was genuine.

Not sure whether this could happen to you? Have us check your email security in 30 minutes. You pick the time, and written next steps follow.

Key takeaways

• A fake sign-in page can capture the session after text codes, app codes or push approvals.
• SPF, DKIM and DMARC can pass on mail from a taken-over account.
• Passkeys and security keys stop the relay, but not consent phishing, help-desk resets or a compromised device.
• Decide who can lift a lockout, and make them call the person back first.

How does a supplier email compromise work?

The attacker already controls a mailbox at your supplier. Then:

1. The message arrives from your supplier’s real address, sometimes inside an existing thread.
2. The link opens a fake sign-in page that sits between you and the real Microsoft or Google sign-in.
3. You type your password. The fake page passes it on, the real service asks for MFA, and the fake page shows you the same prompt.
4. You approve. The real service issues a session token, the digital pass that proves you are signed in, and the attacker’s server keeps a copy.
5. The attacker uses the token, so your password and MFA are already counted. Microsoft’s researchers say this is “not a vulnerability in MFA”.

In the logs, MFA shows as satisfied. What follows stands out: an inbox rule that hides replies, a new MFA method, or new messages in live payment threads.

Why SPF, DKIM and push MFA don’t stop it

SPF lists the servers allowed to send mail for a domain. DKIM adds a digital signature that shows a domain vouches for the message and that it was not changed on the way. DMARC checks that the sender a reader sees matches the domain SPF or DKIM verified, and tells receiving servers what to do with mail that fails both.

On our reading of how they work, all three pass here, because the mail leaves through your supplier’s own systems under their own domain. They stop forged senders (see our piece on AI-assisted phishing), not a genuine account in the wrong hands.

Push approval does no better: you approve on your phone, the approval goes to the real service, and the fake page keeps the session. Microsoft Threat Intelligence’s March 2026 research found the page showing number matching too, and codes fare the same because the page asks you to type them in.

What stops it: passkeys and security keys

A passkey is a sign-in credential kept on your device and confirmed with a fingerprint, face or PIN. A security key is a physical device that does the same job. Both are phishing-resistant, because they work only on the real site’s domain and a fake page gets nothing usable.

ASD (the Australian Signals Directorate) asks for it too. Its Essential Eight maturity model requires phishing-resistant MFA from Maturity Level Two (November 2023 model).

They are not a cure-all. Device-code phishing (typing an attacker’s code into a real sign-in page), OAuth consent phishing (granting an attacker’s app access to your mail), help-desk resets and a compromised device sit outside what a passkey can check. Weaker methods left registered give attackers a downgrade route.

Register keys before you enforce them, then remove the weaker methods. Enforcing first locks people out.

Microsoft 365: what your licence allows

Business Basic and Business Standard include Entra ID Free, which has security defaults but not Conditional Access. Conditional Access (Microsoft’s rules for who signs in and how) and authentication strengths, which can require a phishing-resistant method, need Entra ID P1. That comes with Business Premium.

Entra ID Protection’s detections for relayed sign-ins and suspicious inbox rules are premium detections that Business Premium alone does not include, because it has Entra ID P1 and no Defender for Cloud Apps. Ask your IT provider what your plan alerts on. Our guide to identity security in Microsoft 365 covers Conditional Access in more depth.

Google Workspace

Set 2-Step Verification to security keys only (passkeys count) and restrict third-party app access. In that mode admins must issue backup codes, so settle the lockout process first. An alert for new forwarding addresses or filters needs a custom alert centre rule, so check your edition supports it.

Who can lift a security lockout?

Microsoft Threat Intelligence’s 2026 reporting describes fake IT help desks on Teams warning staff of a lockout. ASD’s 2025-26 threat report describes callers who talk help desks into resetting passwords and moving MFA tokens.

Microsoft advises verifying identity through a rigorous process before any help-desk credential or MFA reset. Our rule: name the one or two people who can lift a lockout or reset MFA. They ignore requests that arrive by email, chat or an inbound call, and phone the person back on a number already on file.

Afterwards they end every session, register MFA again and log the reset. This is our recommendation, not an ASD rule; the session steps draw on ASD’s recovery guidance.

What to do in the first hour

This checklist assumes someone has clicked. It draws on ASD’s recovery guidance and adds steps for stolen sessions, which are our own.

1. Call your bank first if money moved or bank details changed. Ask whether it can stop the payment.
2. Tell your IT provider. Have them sign the person out of every session, because a new password alone does not remove the attacker.
3. Remove sign-in methods the person did not add, then register a passkey or security key.
4. Look for inbox rules, forwarding and connected apps you did not create, and for sent items the person did not send.
5. Report it through ReportCyber at cyber.gov.au/report, or call the hotline on 1300 CYBER1 (1300 292 371), which runs 24 hours. Note the reference that starts with CIRS-.
6. Warn your contacts, by phone for anything involving payment.
7. Call IDCARE on 1800 595 160 for free support if you have been affected by identity theft.

Business email compromise reporting duties in Australia

For most businesses the main legal question is whether the Notifiable Data Breaches (NDB) scheme applies to you, though sector rules can add duties.

The scheme covers unauthorised access to, or disclosure of, personal information where serious harm is likely and you cannot prevent it with action. A mailbox holding customer IDs, tax file numbers or payroll details may qualify. On our reading, what matters is what the attacker could read in the mailbox, not what the fraud used.

If you suspect an eligible data breach, the Office of the Australian Information Commissioner (OAIC) says to assess it quickly and take reasonable steps to finish within 30 calendar days. If it is one, notify affected people and the OAIC as soon as practicable.

Most businesses with turnover of $3 million or less are outside the Act, but not all: health service providers and tax file number recipients are among the exceptions. If unsure, ASD’s guidance says to seek legal advice.

Checklist: what to do this week

Do today

• Switch off external auto-forwarding for all mailboxes.
• Confirm MFA is on for everyone. On Business Basic and Standard, if security defaults are on, they also block device-code sign-ins.
• Agree that bank-detail changes are confirmed by phone, on a number you already hold.
• Write the lockout rule down, and copy the first-hour steps onto one page.

Do this month

• Issue passkeys or security keys to finance, executives and admins first. Register them before you enforce them.
• On Business Premium, use Conditional Access to require a phishing-resistant method for those people.
• Limit which apps staff can approve for mail access: verified publishers only in Microsoft, trusted, limited or blocked settings in Google.

Ask your IT provider

• Which MFA methods can staff still use, and who relies only on text codes or push approval?
• Can anyone approve an app’s access to mail without an admin?
• Who is alerted when someone adds an MFA method or a forwarding rule, and does our licence cover it?
• How do you confirm it is really our staff member before you reset MFA or lift a lockout?

The first-hour steps above are short enough to copy onto one page. Bring your copy to a half-hour call where we check your setup against them. Arrange it on our contact page, and written next steps follow.

Frequently asked questions

Can phishing bypass MFA?

Yes: in adversary-in-the-middle phishing, a fake sign-in page passes your password to the real service, shows you its MFA prompt and keeps the session once you approve. Text codes, app codes and push approvals do not stop this. Passkeys and security keys do, if weaker methods are removed.

What is phishing-resistant MFA?

It is MFA that a fake site cannot relay. The credential is tied to the real site’s domain, so a look-alike page gets nothing it can use. In practice that means passkeys and security keys, which follow the FIDO standard, while codes and push approvals are not.

What should I do if a supplier’s email is compromised?

Phone your supplier on a number you already hold, not one from the email. Hold any change to bank details until they confirm it that way. Check whether anyone clicked a link, and if so, follow the first-hour steps above and tell your IT provider.

Do I have to report a data breach in Australia?

Mainly if the Privacy Act covers you, personal information was accessed or disclosed without authorisation, and serious harm is likely. Most businesses with turnover of $3 million or less are exempt, with exceptions such as health service providers. Take reasonable steps to assess within 30 days, then notify the OAIC and affected people as soon as practicable.

Book a 30-minute email security check

Choose a time on the contact page. In 30 minutes we go through four things: the MFA methods your staff use, your sign-in and app-consent settings, your mail forwarding and alert settings, and how a lockout gets reset. You then get written next steps.

For a wider look, try our security posture assessment, a two-week fixed-price review. We reply to enquiries within one business day.