When One Email Cost a Recruiter £90,000
“I thought it couldn’t happen to me.” — Mark Stevens, MD
We hear a version of this sentence often. Nobody plans to click the wrong link. But phishing emails aren’t designed to be spotted — they’re designed to look exactly like the routine, slightly-urgent admin messages we all get several times a day. This is the story of one recruitment consultant who did everything most business owners do, and what it cost him.
(Note: “Mark Stevens” is an alias. This is a true story — the details have been shared with permission, with the client’s identity protected.)
Background
Mark had spent years building a recruitment business the traditional way — through relationships. When he decided to downsize to a single-person consultancy, it made sense: fewer overheads, a tighter focus on the high-end, lucrative end of the placement market, and years of contacts to lean on. It’s a familiar, sensible move for an experienced recruiter. Nothing about it should have put him at risk.
The Risk
Recruitment consultants sit on exactly the kind of data attackers want — candidate details, client contacts, and a steady flow of invoices moving between the two. A one-person operation often has no IT team, no dedicated email security, and no one double-checking what lands in the inbox. That combination — valuable data, high trust in email, and limited technical oversight — is precisely the profile criminals look for.
The attack began with a single email, made to look like a routine Office 365 notification: “Your mailbox has exceeded its mail-quota and is due for upgrade.” Mark clicked the link, followed the instructions, and thought nothing more of it.
He had no way of knowing that the click had silently installed a keystroke logger — software that records everything typed on a keyboard and sends it back to whoever is watching. From that moment, every username, every password, and every piece of confidential information Mark typed was visible to the attacker.
For 26 days, nothing seemed wrong. Behind the scenes, the attacker was learning Mark’s business: how he worked, and specifically how he invoiced. Mark used a simple Word template for billing, pre-populated with his bank details, so he wouldn’t have to re-enter them each time. On day 27, Mark raised two new invoices totalling £90,000 — a good day’s work. What he didn’t know was that the attacker had already altered the bank details in that template. Both invoices went out with the fraudsters’ account details in place of his own.
By day 39, when neither client had paid, Mark called to chase — and was told, in both cases: “We have already paid that invoice — we can send you the confirmation.”
The £90k was gone. And the financial loss, painful as it was, wasn’t the part that hit hardest.
“It’s truly unimaginable — you know you’ve been robbed. In this case, it’s £90k. That’s a lot of money, but it’s not even the worst part. You’re waiting to see what else they may have taken — are they in your bank accounts? Have they stolen client information? You must face your clients — in my case, all the professionals on my books — and tell them what has happened, because their data may have been compromised.” — Mark Stevens, MD
What This Attack Exploited
Nothing about Mark’s business was careless. This is what makes the story worth telling: a phishing email, a single click, and a template that trusted its own data — that’s all it took. Three gaps made it possible:
- No email filtering to catch the phishing message before it landed. The email impersonated a trusted brand and used urgency to prompt a fast click.
- No protection against the malware the click triggered. A keystroke logger ran undetected for weeks, harvesting credentials and confidential information.
- No process to verify a change in payment details. Once the attacker had access, altering a Word template was enough to redirect £90k without triggering any alarm.
This is exactly the pattern behind Business Email Compromise (BEC) — and it isn’t rare. BEC scams have cost victims over $55 billion globally since 2013, and 91% of cyber attacks start with a phishing email.
How Our Email Security Service Closes These Gaps
This is the kind of attack our Email Security service exists to stop, at each of the three points above:
- Stopping the phishing email before it’s ever seen. Advanced filtering identifies and blocks phishing, spoofed-sender, and impersonation emails — including messages designed to mimic trusted platforms like Microsoft 365 — so the malicious link never reaches an inbox to be clicked.
- Blocking the malware payload. Protection against malware and ransomware delivered via email link or attachment means a click, if it happens, doesn’t turn into a silent, weeks-long compromise.
- Guarding against invoice and CEO fraud specifically. Our Email Security service is built to catch the impersonation and account-takeover techniques attackers use to redirect payments — the exact mechanism that turned Mark’s routine invoicing into a £90k loss.
For recruitment agencies, there’s a second benefit that matters just as much as the technical protection: strong email security is increasingly expected — and sometimes required — to win NHS, government, and enterprise framework contracts, many of which now ask for Cyber Essentials certification as a condition of doing business.
The Takeaway
Mark’s business didn’t fail through negligence. It failed because one very convincing email met an inbox with no defence behind it — and because a trusted internal document turned out to be the perfect place for an attacker to hide. Any recruitment consultancy handling client payments and candidate data by email carries the same exposure, whether it’s a single consultant or a team of twenty.
If you’d like to know where your own email security stands — and whether your business would catch an attack like this before it reaches day 27 — book a free Security Check with Security Everywhere. No pressure, no jargon — just an honest look at where the gaps are.
Sources: FBI Internet Crime Complaint Center (IC3), “Business Email Compromise: The $55 Billion Scam,” Public Service Announcement I-091124-PSA, published 11 September 2024. AAG IT Support, “The Latest Phishing Statistics,” updated October 2025.
- Cyber Essentials vs Cyber Essentials Plus: What’s the Difference and Which Do You Need? - 13 October 2026
- What Is Payment Diversion Fraud? How It Works and How to Stop It - 6 October 2026
- Recruitment Firm Loses £90k to Phishing Email - 21 September 2026
