Every few months, another company discovers that a stranger has been reading its email for weeks. The intruder did not break through a firewall or exploit a rare software flaw. They signed in with a real username and password, and from that moment the systems treated them as an employee.
Corporate account takeover sits behind many of the costliest incidents a business can face. Attackers gain control of a genuine account, then use its reputation, history, and permissions to move money, steal data, or trick colleagues. Defenders keep losing ground for ordinary reasons: predictable targets, uneven authentication, and people asked to make quick decisions under pressure. The sections below explain why these attacks keep working, and which layered defenses change the odds.
Finance Teams Are the Natural Target
Money is the usual objective, so attackers study how money moves inside a business. Accounts payable clerks, controllers, treasury staff, and executive assistants appear in company directories, press releases, and professional networking profiles. A criminal who controls one of their mailboxes can read invoice formats, approval chains, and the list of vendors that get paid each month.
The scams built on that knowledge are rarely complicated. A message arrives inside a real thread asking that the next payment go to a “new” bank account. A supplier’s mailbox is taken over, and a legitimate invoice is replaced with an identical one carrying different payment details. An executive’s account is used to approve an urgent transfer that nobody wants to question. Each version works because it fits an existing workflow.
Timing sharpens the effect. Attackers favor month-end close, holidays, and days when approvers travel, since fewer people are checking and requests that skip the usual route seem plausible. The message comes from a real account, so filters looking for suspicious senders have little to flag, and recipients have no reason for doubt.
Recovery is difficult once funds move. Banks can sometimes recall a transfer if they hear about it quickly, but a delay of even a day shrinks the odds. That imbalance explains the persistence of these scams: the attacker needs one successful payment, while the business needs every control to hold every time.
Weak Authentication Keeps the Front Door Open
Passwords remain the most common way into corporate accounts, and passwords are a fragile foundation. People reuse them across work and personal services, choose predictable patterns, and type them into convincing fake sign-in pages. When a password exposed in an unrelated breach matches a corporate login, attackers simply try it, a technique known as credential stuffing.
Multi-factor authentication helps, though its presence does not guarantee protection. Gaps appear when MFA is optional for some users, when older protocols that cannot prompt for a second factor stay enabled, or when shared and service accounts are exempt. Some methods are also easier to defeat than others. Text message codes can be intercepted through SIM swapping, and push approvals can be accepted by a tired user after repeated prompts.
Attackers have adapted to MFA. Adversary-in-the-middle phishing kits sit between the victim and the real sign-in page, relay the password and the one-time code, and capture the session cookie that proves the login succeeded. With that cookie, the intruder can reach the account without being asked for a second factor at all. Malware that steals stored session tokens has a similar effect.
Stronger options exist. Phishing-resistant methods such as FIDO2 security keys and passkeys tie authentication to the genuine website, which makes relay attacks fail. Shorter session lifetimes, device-bound sessions, and blocked legacy protocols narrow the window further. Starting with finance staff, executives, and administrators puts the strongest controls where a loss would be greatest.
Social Engineering Fills Every Gap Technology Leaves
Even with good authentication, attackers can ask for what they cannot steal. Social engineering targets the person instead of the system, using familiar pretexts: a request from the chief executive, a notice from IT about an expiring password, or a vendor chasing an overdue invoice. These stories succeed because they match the rhythm of ordinary work.
Research makes them better. Public profiles reveal who reports to whom, which projects are underway, and which suppliers a company uses. A message that mentions a real project and copies an executive’s usual phrasing draws far less suspicion than a generic one. Generative AI tools have made polished, error-free text easy to produce, which removes a clue that employees were once taught to look for.
Phone calls add pressure. An attacker may ring the help desk posing as a locked-out employee and ask for a password reset or a new MFA device. The caller sounds confident, knows the employee’s name and manager, and uses urgency to discourage verification. Help desks that follow a script requiring identity checks, such as a callback to a number already on file, close this path.
Training matters, but it works best alongside the process. Employees should not be the last line of defense against a flawless forgery. Procedures that require a second person to approve changes to payment details, and a known channel for confirming unusual requests, protect the business even on the day someone is fooled.
Layered Defenses and the Role of Security Vendors
No single control stops account takeover, so defenses are stacked. Email filtering reduces the volume of malicious messages. Authentication controls limit what a stolen password can do. Monitoring catches strange behavior after a login. Payment procedures and training add human checkpoints. Each layer assumes the previous one will occasionally fail.
Many security vendors supply tools across these layers, and Mimecast is one of the names businesses encounter when comparing email security, awareness training, and threat detection. Buyers should ask what a product detects, how it treats internal and compromised-account mail, how quickly it can pull a message from every inbox, and how it connects to existing identity and security tools.
Comparisons deserve a short trial against realistic scenarios. Ask how Mimecast, or any alternative, reports on messages sent from a trusted but compromised account, since that is the case ordinary sender checks miss. Ask how alerts reach the team, how long data is retained, and what administrators can do without opening a support ticket. A tool that produces many alerts nobody reads adds little protection.
Configuration counts as much as product choice. Email authentication records such as SPF, DKIM, and DMARC make it harder to spoof the company’s domain. Mailbox rules that forward mail outside the company should be restricted and monitored. Conditional access policies can demand stronger checks for risky sign-ins. These settings work best when one person owns them and reviews them on a schedule.
Building a Response Plan Before It Is Needed
Speed decides how much damage a takeover causes, which is why the plan should exist before an incident. A short written playbook, rehearsed once or twice a year, saves minutes that matter when money or data is leaving. A sensible sequence looks like this:
- Contain the account by resetting the password, revoking active sessions and tokens, and removing unknown MFA devices.
- Inspect the mailbox for forwarding rules, delegated access, and hidden filters.
- Review recent sign-ins and activity to learn when the intruder arrived and what was touched.
- Call the bank at once if any payment was affected, and warn partners who received messages from the account.
- Search for and remove related messages from other mailboxes.
- Record what was learned and tighten the controls that failed.
Communication belongs in the plan as well. Finance, legal, IT, and leadership should know who decides what, who contacts customers or regulators, and where the incident record is kept. Confusion over ownership costs time in the first hour, which is the hour that counts.
Drills reveal weak points that documents hide. A tabletop exercise built around a fake supplier invoice, for example, shows whether finance staff know how to reach the bank after hours and whether IT can revoke a session quickly. Fixing those small gaps is cheaper than discovering them during a real loss.
Final Analysis
Corporate account takeovers keep succeeding because they exploit three durable weaknesses: valuable targets in finance, authentication that falls short of the threat, and people who are asked to trust what looks familiar. None of these can be removed completely, but each can be reduced.
Businesses that stack phishing-resistant authentication, careful payment procedures, monitoring, and a rehearsed response plan make the attacker’s task much harder and the damage smaller. The goal is not perfection. It is an environment where a single stolen password or a single convincing email no longer decides the outcome.
Smaller organizations can begin with three moves: enroll finance and administrators in phishing-resistant authentication, adopt a mandatory callback rule for payment changes, and write down the first-hour response steps. Those changes cost little and address the situations most likely to cause real losses.
