Most owners never spot a hacked business email themselves. They find out when a customer calls about an invoice nobody sent, or when the bank asks about a payment nobody approved.
By that point the account has usually been open for weeks. Here is what you can check yourself in about ten minutes, and what to hand to whoever manages your IT.
What a hacked business email actually looks like from the inside
Somebody signed in as you. That is the whole of it. In most cases nothing was broken and no software was installed. The password was typed in correctly, by somebody who had no business holding it, taken either from a file of stolen passwords or from a fake sign-in page that looked exactly like the real one.
Once they are in, they rarely make noise. A mailbox is worth far more to them quiet than loud. They read for days. They learn which supplier you pay on the fifteenth, how your bookkeeper phrases a request, which customer is waiting on a large invoice. Then they send one message, at the right moment, that costs you money.
Four signs of a hacked business email you can check today
Mail that disappears before you read it
Attackers usually set the mailbox to quietly move or copy certain messages, so the ones that would give them away never reach you. Anything containing the word invoice, payment or wire lands in a folder you never open. That is why a mailbox can feel completely normal while somebody else is reading it every morning.
Replies to messages you never sent
If a customer answers a message you have no memory of writing, treat it as a real signal rather than a mix-up. The same goes for a supplier thanking you for a document you did not attach.
Sign-ins from places that make no sense
Your email service keeps a record of every sign-in, with the time, the country and the device. You do not need to read that record yourself. You need somebody to look at the last thirty days and tell you plainly whether anything came from a place or a device that does not match your team.
A supplier who suddenly changed bank details
A payment change request arriving by email, from an address you recognize, in a thread you were already having, is the classic ending of this story. Because the message really does come from a compromised mailbox, it passes every filter you pay for.
Password reset messages you never asked for
A reset notice for your accounting system or your bank, arriving on a quiet afternoon, means somebody is already inside the mailbox that controls those accounts. Your email is the master key to almost every other login in the business, because that is where the reset link lands. Treat one unexplained reset notice as seriously as ten unusual sign-ins.
Why changing the password is not always enough
When you sign in, the service hands your device a pass that keeps you signed in for days or weeks, so you are not typing your password all morning. If somebody copied that pass, resetting the password leaves them holding it. That is how an account can look clean on Monday and start sending invoices again on Thursday.
Ask your IT provider: sign that account out of everywhere, not just reset the password.
What it costs when nobody notices
In 2025, the FBI crime complaint center recorded 24,768 reports of this exact kind of fraud, for $3,046,598,558 in losses, according to its 2025 Internet Crime Report. That averages out to roughly $123,000 per report. For a thirty person company the shape of that number matters more than its size, because the loss arrives in a single payment rather than as a slow leak.
Georgia appears in the national top ten both for the number of complaints filed and for the total money lost, according to the same report. In other words, this is not a coastal problem happening to somebody else. Companies in Augusta, Columbia County and across the state are inside that count.
Whose mailbox to check besides your own
Owners tend to assume they are the target, and they usually are not the most useful one. The mailboxes worth reading, from an attacker point of view, belong to whoever pays the invoices, whoever signs the contracts, and whoever handles payroll. Those three people see the money move.
Add to that list any shared address such as accounting or info, because shared mailboxes are the ones where nobody notices a rule that was not there last month. They also tend to keep the same password for years, since changing it means telling four people.
When you ask for a check, ask for all of those accounts at once. Checking one mailbox and declaring the problem solved is how companies end up handling the same incident twice in a quarter.
The first hours matter more than the first week
If money has already left the account, call your bank before anything else and ask for a wire recall. Then file a report at ic3.gov the same day, even if it is a Saturday. The FBI runs a team whose only job is to contact the receiving bank and ask for the funds to be frozen before they move on, and that process works in hours rather than weeks.
Keep every fraudulent email exactly where it is. Your bank, your insurer and your IT provider will each need them, and deleting the evidence is one of the most common mistakes made in the first panicked hour.
The questions to ask your IT provider
Bring these five, in this order:
- Show me every forwarding and message rule on my mailbox and on our finance mailboxes, and tell me when each one was created.
- Sign this account out everywhere, then confirm to me that it is done.
- Which of our accounts can still be opened with a password alone, with no code on a phone?
- Besides mine, whose inbox would be worth reading for two weeks before an attack?
- If this happens on a Saturday, who picks up the phone, and how quickly?
If you cannot get clear answers to those five questions today, the gap is not really in your email settings. It is in who is watching the account, which is the job of continuous monitoring and response rather than of any single tool.
| Alchanis Technical Services is a veteran owned managed security and IT provider working with small and mid-size businesses across Augusta, Columbia County and Georgia.
If nobody in your business can answer those five questions this week, start the conversation at alchanistech.com. |
