Fake internal emails work because they do not look like an attack. The message appears to come from your operations manager, your accountant or you, it refers to something real that is happening this week, and it asks for one ordinary thing: pay this invoice, change these bank details, approve this login. Nothing in it looks dangerous, which is exactly the design.
If your business has ever had to ask “did you really send this?”, this article is about what is actually happening and what you can put in place by Monday. It is written for the owner, not for whoever manages the mail system.
Why fake internal emails get past the filter you already pay for
Your spam filter is built to catch messages that arrive from outside and look suspicious. Fake internal emails are engineered to trip neither of those wires.
There are 2 ways attackers get there. In the first, they register a web address that looks like yours at a glance and send from it, so the display name in your team’s inbox reads exactly like a colleague. In the second, and this is the one that costs the most, they are already inside a real mailbox. Somebody’s password was stolen weeks earlier, the attacker has been reading the mail quietly since then, and when the moment is right they reply inside a conversation that already existed. That message is genuinely internal. It comes from the real address, it sits in the real thread, and there is nothing for a filter to flag.
The same thing now happens outside email. Chat tools let people from other companies message your staff by default, so a stranger can open a conversation that appears in the same window as every internal one and introduce themselves as your help desk. Palo Alto Networks published research in June 2026 describing campaigns where attackers do exactly that, then talk an employee into approving a login prompt.
Ask your IT provider: can someone outside our company start a chat with my team, and if so, why is that still switched on?
The 2 requests worth recognizing
Almost all fake internal emails ask for 1 of 2 things, and knowing which one you are looking at tells you what is at stake.
The first asks you to move money or change where money goes. It arrives as an invoice from a supplier you really use, or as an updated bank account for a payment you were already expecting. The details are correct because the attacker read the real correspondence before writing.
The second asks you to approve access. It arrives as a login prompt on somebody’s phone with a message explaining why they should tap yes, or as a request to confirm a code so the help desk can fix an account. The person tapping approve is not being careless, they are being helpful to somebody they believe works with them.
A money request costs you the same afternoon, and an access request costs you a few weeks later, because the account that got approved becomes the sending address for the next round of messages. By then the attack really is coming from inside.
What fake internal emails cost American businesses, and the part nobody talks about
The FBI runs the national reporting center for this, and its 2025 Internet Crime Report is the closest thing to a real count of what fake internal emails take out of American companies each year. In that year the bureau logged 24,768 complaints of this exact category, business email compromise, with reported losses of just over $3 billion.
The more useful number in the same report is the one about recovery. The FBI operates a team whose whole job is calling banks to freeze a payment that has just left. In 2025 that team worked on about 3,900 cases covering roughly $1.16 billion in attempted theft, and it managed to freeze $679 million of it. That is a success rate of 58%, which means that more than half the time, a business that reported fast got the money stopped before it moved on.
Read those figures honestly. They cover reported cases only, and companies that never report are invisible in them, so the real totals are larger. What transfers to you is not the national total. It is the recovery rate, because it is the only figure on this page you can influence. The variable is how fast somebody in your company picks up the phone, and that depends entirely on whether they know who to call before it happens.
Ask your IT provider: if we sent a payment to the wrong account at 4 p.m. on a Friday, who do we call first, and is that number written down somewhere other than in your head?
The rule that actually stops this
There is one rule, it costs nothing, and it works whether the message came from a lookalike address, a real mailbox or a chat window.
Any request to move money, change bank details or approve access gets verified out loud, on a number you already had before the message arrived. That excludes the number printed in the signature, the number given in the message itself, and any reply inside the thread, because if the mailbox has been taken over then the attacker is reading those replies too.
Write it as a policy in one sentence and tell your team that nobody will ever be criticized for making that call, including when it turns out to be you who sent the message. That last part is what makes the rule survive contact with a busy week. In most companies where this fails, somebody had a doubt and did not want to look slow in front of the boss.
One more thing makes the rule hold. Decide now what happens to the person who calls and turns out to be wrong, because that is the moment the policy either becomes real or quietly dies. In companies where the rule survives, the owner has said out loud that a wasted phone call is a good outcome and has thanked somebody publicly for making one. In companies where it does not, nobody ever said anything, and after a few weeks people go back to reading the message and deciding for themselves.
Put a dollar figure on it if you want it followed. Below a certain amount, 1 person can approve. Above it, 2 people and a phone call. Owners who set that number find the rule gets applied, because it stops being a judgment call.
The questions to bring to whoever handles your technology
Ask for the answers in writing. The delay in answering tells you as much as the answers.
- If a message arrives from a web address that is one letter different from ours, does anything mark it as external before my team reads it?
- Can somebody outside the company start a chat with my staff in our collaboration tool, and can that be turned off?
- If one of our mailboxes were being read by somebody else right now, what would tell us?
- When an employee approves a login prompt they did not expect, does anyone see that, or does it just succeed quietly?
- Who is the named person we call in the first hour if a payment goes to the wrong account, and what is the bank’s number for that?
If question 3 comes back as “we would probably notice”, treat that as a no. Quiet mailbox access is the part of this that runs for weeks, and noticing is a thing somebody either does on purpose or does not do at all.
What to take away
Fake internal emails are not a problem you can buy your way out of, and no filter will ever catch the message that comes from a real account in a real conversation. The companies that lose money to this are not the ones with weak technology, they are the ones where a single person was allowed to act on a written instruction without speaking to anybody. What closes the gap is a single habit that a company of 30 people can adopt in an afternoon: money and access get confirmed on a channel the message did not choose. Everything else on this page exists to support that one sentence.
