Lost by Australians to payment redirection in 2025, also known as business email compromise. It is the second-largest scam type by loss in the country, and one of the only ones still rising.
Almost none of it involved breaking through anything. It involved a correct password, typed into a real login page, on a normal Tuesday.
Source: ACCC National Anti-Scam Centre, Targeting scams 2025, published March 2026.
SensorZero watches for the sign-in, not the invoice. Connect your email and it reads the activity around your mailboxes from the moment it is on.
Nothing is sent anywhere and no email is required. Answer honestly. Most businesses we speak to answer no to at least three.
Answer the five above and we will tell you what they add up to.
Nobody sat down and picked your business. Sign-in details get harvested in bulk and sorted afterwards, and a ten-person firm that pays invoices is worth exactly as much as a large one. What follows is one real pattern, in the order it happens.
There are three common ways yours ends up in the pile. None of them require anyone to target you.
An email points at a page that looks exactly like the Microsoft or Google sign-in. Your staff member types the password and approves the prompt on their phone, and it all works, because the fake page is passing it straight through to the real one and keeping the answer. This is why having multi-factor turned on does not settle the question on its own.
A malicious download, an email attachment, or a fake software update installs malware that quietly reads every saved password and signed-in session out of the browser and sends them back. It is sold as a subscription service, so whoever uses it does not need to be technical.
Credentials are bought and sold on the basis of what the business is, where it is, and roughly what it earns. Sometimes they came from an old breach on an unrelated site where the same password was used again.
They are not breaking in. They are logging in, with a correct password and a session your provider has already approved. To Microsoft 365 or Google Workspace it is your bookkeeper starting the day, so nothing is flagged and nobody is told.
They read. They do not delete anything, change anything, or lock you out, because that would give them away. They are learning how your business asks to be paid: who approves what, when you invoice, which client owes the most, how you sign off.
The one thing they do change is small enough that nobody sees it.
Right thread, right amount, right sign-off, because they copied a real one. One line is different. Your client pays it, and the money is gone that afternoon.
You find out three weeks later, when the client asks why the account is overdue.
Every alarm you already have is pointed at Day 23. SensorZero is pointed at Day 1.
SensorZero correlates sign-ins, mailbox rules and what happens on your computers. When something matters, it does not sit in a console nobody opens. An AI agent triages it and escalates to you in plain English, with what it saw and exactly what to do next.
SensorZero collects the activity from your email, your computers and your network in one place, and checks it as it arrives. Who signed in, from where, and what they changed once they were in.
Sign-ins, locations, mailbox rules, permission changes, file sharing. This is where payment redirection starts and ends.
One lightweight agent per machine. What ran, what it touched, and whether it went looking for saved passwords.
Where your network is talking to, including the things a laptop cannot tell you about itself.
Small businesses are viable targets, and some lose between $50,000 and $400,000 or more before they realise an incident has happened at all. Phishing emails and credential stealers are aimed at companies of every size.
Keep them, but they do not see or prevent everything. Multi-factor can be bypassed by a fake login page that passes your details straight through to the real one, and your antivirus will not catch that either.
You have us. Connect your systems and logs, and our AI SOC triages and escalates the alerts that matter to you. You can also partner with an MSP to run it alongside you, and the SensorZero team performs hunts and escalates ad-hoc findings.
Start free. SensorZero fixed plans then make the cost predictable, so you know what you are paying, with no capex and no year-one lock-in.
You get the email above: what happened, why it matters, and the exact steps to take. It is written in plain English, not console output.
A team of experienced incident response and digital forensics engineers, who have worked large scale incidents for large and small companies. SensorZero is that experience, productised.