Background
Our client ran a small recruitment consultancy. It’s a familiar story in the sector — during a difficult trading period, she scaled the business right down, eventually running it as a single person working from home.
Before she made that move, we sat down with her and recommended a modest security upgrade: better protection on her Mac, stronger email security, a proper backup, and a password manager. All in, around £25 a month. Times were tight, and she needed to cut costs wherever she could, so she declined. We understood, and wished her well.
The Risk
In January this year, she called us with news. She’d made two recruitment placements with a combined invoice value of £91,000 — a strong result for a lean, one-person operation. But somewhere along the way, her email account had been quietly compromised.
The invoices sent to her customer were intercepted and altered. Her customer then received a message that appeared to come from her, saying the bank details had changed, and asking them to pay the new account instead.
It’s a classic pattern — business email compromise, sometimes called invoice fraud — and it works precisely because it doesn’t look like an attack. The customer had no reason to doubt an email that seemed to come directly from a trusted, known supplier. As our client put it:
“…my email got intercepted, the invoices were changed, and an email was received by my customer saying bank details have changed, please can you pay the new bank details.”
What We Did
By the time the fraud came to light, the money had already gone. The customer had paid the full £91,000 into the criminal’s account, believing it was a genuine payment instruction. Understandably, having already paid once in good faith, they were reluctant to pay the same invoice a second time.
We worked through what had happened with our client, but this is the hard truth about invoice fraud: once the payment has cleared into the attacker’s account, it is very rarely recoverable. The real opportunity to stop this had been months earlier, with the upgrade that was declined to save £25 a month.
The Result
£91,000 was gone — sent to a criminal’s bank account instead of the recruitment consultancy’s own. Her customer, having already paid once, did not want to pay again. A security upgrade costing roughly £25 a month had been turned down to save costs; the fraud that followed cost far more than the protection ever would have.
We say this not to say “we told you so” — genuinely, we didn’t enjoy making that call any more than she enjoyed receiving it. We say it because it’s the clearest illustration we have of a simple truth: in a business handling client payments, basic email security isn’t a nice-to-have. It’s the difference between a normal Tuesday and a £91,000 loss.
Why This Matters for Recruitment Agencies and Regulated B2B Sectors
Recruitment agencies, law firms, and other fee-based professional services regularly invoice large sums under time pressure — exactly the conditions attackers exploit with a convincing “bank details have changed” message.
Lean or single-person operations are especially exposed. There’s no second pair of eyes to question an unusual payment instruction, and cost pressure often means security is the first thing cut when times are hard — precisely when the business can least afford a loss like this one.
Once a customer has paid a fraudulent invoice in good faith, they’re often unwilling, or unable, to pay the legitimate amount again — leaving the loss to fall on one or both businesses.
Basic protections — email account security with multi-factor authentication, and MFA on financial systems like Xero — cost a fraction of a single fraudulent payment, yet are still routinely skipped to save a small monthly fee.
Where Do You Stand?
If your agency handles client payments or invoices — even occasionally — it’s worth knowing where you stand before it becomes a case like this one.
We offer a free, no-obligation cyber exposure check covering email security (DMARC), exposed subdomains, and dark web credential exposure. No pressure, no sales pitch — just a clear picture of your current exposure.
Note: details in this case study have been anonymised to protect client confidentiality. This account is drawn from a recorded interview given by Francis West on Security Everywhere’s YouTube channel.
- Cyber Essentials vs Cyber Essentials Plus: What’s the Difference and Which Do You Need? - 13 October 2026
- What Is Payment Diversion Fraud? How It Works and How to Stop It - 6 October 2026
- Recruitment Firm Loses £90k to Phishing Email - 21 September 2026
