How Email Attacks Disrupt Business: A Practical Guide to Email Security

• Cyber Risk
• Malware & Ransomware
• Threat Actors

Introduction

Email-based attacks continue to grow steadily year over year. For organizations, this is no longer just another cybersecurity challenge — it is a direct question of business continuity and operational resilience.

According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), more than 90% of successful cyberattacks begin with a phishing email, making email the primary initial access vector. Credential theft, compromise of information assets, malware deployment, and even full-scale infrastructure encryption frequently originate from a single email message that bypasses technical or human controls.

Threat actors continuously refine social engineering techniques, carefully adapt their tactics to specific business processes, and actively leverage artificial intelligence. AI-powered tooling enables attackers to generate highly convincing messages at scale, personalize attacks based on publicly available or compromised data, and dynamically adjust content to evade both user suspicion and automated detection mechanisms.

In the context of hybrid warfare and increasing geopolitical tension, organizations face not only mass cybercrime campaigns but also targeted, state-sponsored operations. These campaigns are often long-running, well-resourced, and focused on disrupting critical business processes rather than achieving quick financial gain. Under such conditions, maintaining basic cyber hygiene is no longer sufficient — organizations must adopt a systematic, risk-based approach to email security.

This article explains how the most common attacks targeting corporate email impact business operations, why email remains a preferred entry point for attackers, and why investment in email security should be viewed as a direct investment in business resilience and continuity.

1. Business Email Compromise (BEC)

What It Means for Business

Business Email Compromise (BEC) is a targeted attack in which threat actors impersonate executives, business partners, vendors, or customers to manipulate employees into executing financial transactions or disclosing sensitive business information.

Unlike mass phishing campaigns, BEC attacks are highly personalized. Attackers spend time studying the organization’s structure, communication patterns, approval chains, and internal workflows. They know who authorizes payments, how financial requests are typically phrased, when executives are traveling or unavailable, and which departments are most likely to comply with urgent requests.

The Real Cost of BEC

The business impact of BEC attacks is well documented and consistently severe.

In 2019, Nikkei, Japan’s leading financial news organization, lost $29 million as a result of a single BEC incident. An attacker successfully impersonated an executive of an international company and convinced employees to transfer funds to a fraudulent bank account.

According to the IBM Cost of a Data Breach Report 2022, Business Email Compromise is the second most expensive type of security incident, with an average total cost of $4.89 million per incident. This figure includes costs associated with detection, investigation, response, recovery, operational disruption, and reputational damage.

Data from the FBI Internet Crime Complaint Center (IC3) further illustrates the scale of the problem. In the United States alone, BEC attacks resulted in direct financial losses of $2.7 billion in 2022. Subsequent IC3 reports show that the threat remains persistently high, with reported losses of $2.95 billion in 2023 and $2.77 billion in 2024. These figures confirm that BEC is not a short-term trend but a systemic, long-term risk to businesses.

Why BEC Works

Traditional technical controls are often ineffective against BEC attacks. Messages typically originate from legitimate or lookalike email addresses, contain no malicious attachments or links, and therefore bypass many email security filters.

Instead, BEC relies on social engineering techniques such as urgency, authority, and trust, combined with a deep understanding of internal business processes. Requests often appear plausible and contextually correct, making them difficult for employees to question.

For organizations, this leads to a critical conclusion: even best-in-class security technology cannot compensate for weak or nonexistent financial verification processes. If a payment or sensitive action can be executed based solely on a single email request, the organization remains fundamentally vulnerable.

How to Defend Against BEC

BEC cannot be mitigated by technology alone. Effective protection requires a coordinated combination of clearly defined processes, independent verification mechanisms, and a strong security culture.

Financial Verification Processes

• Implement mandatory dual approval for all payments above a defined threshold. Any request to transfer funds, change banking details, or onboard a new vendor must be reviewed and approved by more than one authorized individual.
• All financial requests must be verified via an independent, out-of-band communication channel. This may include a phone call, secure messaging platform, or internal ticketing system.
• Critically, verification must rely on contact details already stored in corporate records. Phone numbers or contact information provided in an email request should never be used for confirmation, as attackers frequently include fraudulent contact details.
• Establish clear procedures for urgent or exceptional payment requests. Claims of urgency from executives such as a CEO or CFO should trigger additional verification steps rather than accelerate approval workflows.

Technical Controls

• Enable external email tagging to clearly indicate when a message originates outside the organization, even if the sender name or address appears familiar.
• Deploy protection against domain spoofing by monitoring the registration of lookalike domains similar to your own (for example, ve1stadt.com, velstadt.co) and blocking or quarantining emails originating from such domains.
• Properly configure SPF, DKIM, and DMARC to protect corporate domains from spoofing. Email gateways should enforce DMARC policies and automatically quarantine or block messages that fail authentication checks.
• Monitor for indicators of account compromise, including unusual login times, suspicious changes to mailbox rules, unexpected forwarding configurations, or anomalous email-sending behavior.

Security Awareness and Training

Conduct targeted BEC simulations rather than generic phishing tests. Training scenarios should reflect real business workflows, such as urgent executive payment requests, vendor banking detail changes, or customer document requests.

Educate employees on common BEC red flags, including:

• Unusual or artificial urgency.
• Requests to bypass established procedures.
• Changes in writing style, tone, or language quality.
• Requests for sensitive information without sufficient context.

Foster a culture in which verification is considered a standard business practice rather than a sign of mistrust. Employees should feel empowered to directly confirm requests with executives or partners.

Monitoring and Incident Response

• Monitor financial transactions for anomalies such as sudden changes in beneficiary details, the appearance of new payees, or payment amounts that deviate from normal patterns.
• Establish a clear escalation and response process for suspected fraud, including immediate payment suspension, internal investigation, and executive notification.
• Regularly review and audit access rights to financial systems. A compromised account with payment initiation or approval privileges represents a direct and immediate business risk.

Critical Point

BEC targets people and processes rather than technology. Even the most advanced email security gateway will not prevent fraud if financial operations rely on trust without verification. Protection against BEC must be embedded into daily operational workflows and enforced consistently across all levels of the organization, including senior management.

2. Email Spoofing

What It Means for Business

Email spoofing is an attack in which threat actors forge the sender address to make emails appear as if they originate from a trusted source: a partner, bank, executive, or vendor. The email may contain phishing links, malware, or payment requests.

The core risk is trust. When a message looks legitimate, employees act without suspicion: opening attachments, clicking links, or providing access to systems.

Email spoofing is a common technique used in phishing attacks, combining technical sender impersonation with social engineering. Consequences may include account compromise, data breaches, financial loss, or use of spoofing as an initial access vector for more severe attacks such as ransomware.

For businesses, this represents not just a technical incident but a risk of operational disruption, reputational damage, and regulatory exposure, especially when customer data or financial transactions are involved.

How to Defend Against Spoofing

Technical controls form the foundation, but without organizational processes they are insufficient.

Technical Controls

• Implement SPF, DKIM, and DMARC to authenticate email at the infrastructure level and block most automated spoofing attacks before delivery.
• Use advanced email security solutions that analyze technical and behavioral signals, sender and domain reputation, and spoofing patterns.
• Enforce multi-factor authentication (MFA) across all critical systems to limit impact even if credentials are compromised.

Organizational Controls

• Train employees to identify spoofing indicators such as lookalike domains, header inconsistencies, unexpected attachments or links, and lack of contextual relevance.
• Run regular phishing simulations focused on building reflexes, not punishment.

Monitoring and Response

• Monitor for lookalike domain registrations.
• Establish a clear incident response workflow for suspicious emails.

Critical Point 

Spoofing is a persistent threat. Effective defense requires alignment between technology, processes, and people, not reliance on a single control.

3. Spam

What It Means for Business

Spam is unsolicited bulk email sent to corporate mailboxes without recipient consent. While often perceived as low risk, spam creates operational overhead, increases cognitive load on employees, and raises the likelihood of missing real threats.

How to Defend Against Spam

Effective spam protection requires a combination of layered filtering technologies and disciplined organizational practices.

Technical Controls

• Deploy multi-layered spam filtering. Modern anti-spam solutions leverage machine learning to analyze message content, sender reputation, and behavioral patterns. When properly configured, these controls can block more than 95% of spam before it reaches user inboxes.
• Use greylisting techniques to temporarily reject emails from unknown senders. Legitimate mail servers automatically retry delivery, while many spam bots do not, making this an effective control against automated bulk mail.
• Enable protection against bulk mailing activity, including rate limiting, sender throttling, blocking of known spam domains, and content-based filtering using keywords and message templates.

Organizational Practices

• Define and enforce a corporate email usage policy. Employees should not use work email addresses to register for third-party services, marketing subscriptions, or online surveys, as this significantly increases exposure to spam and data leaks.
• Use dedicated shared addresses for public-facing communication. Instead of exposing personal corporate inboxes, organizations should rely on generic addresses such as info@, sales@, or support@. This approach localizes spam exposure and protects the mailboxes of key employees.
• Educate employees not to respond to spam messages. Any reply confirms that an address is active and often leads to increased spam volume. Suspicious messages should instead be reported or deleted.

Security Hygiene

• Regularly monitor whether corporate email addresses appear in public data breaches. If exposure is detected, organizations should expect an increase in spam and phishing attempts and strengthen monitoring accordingly.
• Use unique email aliases for different services. If an alias begins receiving spam, it becomes immediately clear which service was compromised or improperly shared the address.
• Configure quarantine instead of permanent deletion. Spam filters are not perfect, and legitimate emails from new partners or customers may occasionally be misclassified. Quarantine allows for review and recovery of false positives.

Monitoring and Optimization

• Continuously track filtering effectiveness, including blocked spam volumes, delivered messages, and false positives. This enables ongoing tuning of filtering rules to match the organization’s specific risk profile.
• Maintain updated allowlists and blocklists, ensuring trusted partner domains are not filtered while known spam sources are consistently blocked.
• Implement regular reporting, such as monthly reviews showing how much spam was blocked, how much employee time was saved, and how the load on email infrastructure was reduced.

Critical Point

Spam filtering is not a one-time configuration. Spam campaigns constantly evolve, with attackers rotating domains, changing message patterns, and adapting delivery techniques. Effective spam defense must remain dynamic, supported by continuous monitoring and rule optimization.

Reducing spam volume also lowers background noise within corporate inboxes, making it significantly easier to detect genuinely dangerous threats such as targeted phishing attacks.

4. Email Flooding

What It Means for Business

Email flooding is a denial-of-service attack that involves sending massive volumes of automated, low-value emails, often containing random characters or meaningless content, to overwhelm corporate email infrastructure.

Unlike spam, the goal of email flooding is not advertising, but disruption of availability. When a mailbox or mail server receives hundreds or thousands of messages per second, legitimate emails are delayed or dropped, mail queues grow uncontrollably, and employees lose access to critical communications.

For businesses, this quickly becomes an operational incident. Sales teams miss customer requests, support teams cannot receive tickets, finance teams lose access to payment confirmations, and internal coordination breaks down. In organizations where email is a primary communication channel, even short periods of disruption can halt key business processes.

How to Defend Against Email Flooding

Defending against email flooding requires infrastructure capable of absorbing abnormal traffic volumes, combined with clear operational procedures to maintain business continuity during an attack.

Technical Controls

• Implement rate limiting at the mail server or email gateway level. Limit the number of emails accepted from a single IP address or domain within a defined time window. For example, if a source sends more than 50 emails per minute, traffic can be automatically throttled or blocked.
• Use anti-flood and behavioral filtering mechanisms. Modern email security platforms detect anomalies such as sudden traffic spikes, repetitive message patterns, meaningless content, or identical headers with minor variations.
• Prioritize critical email traffic. Even during a flooding attack, messages from verified partners, internal users, and trusted systems should be processed first to preserve essential business communications.
• Deploy distributed or resilient email infrastructure. Load-balanced or geographically distributed mail servers ensure that if one node becomes overwhelmed, traffic can be redirected to healthy systems, maintaining service availability.

Monitoring and Early Detection

• Enable real-time monitoring of inbound email volumes. Security teams should be alerted when traffic exceeds baseline levels by 5–10x, allowing rapid response before infrastructure becomes saturated.
• Track traffic sources. Flooding attacks often originate from specific IP ranges, subnets, or autonomous systems (ASNs). These can be blocked at the firewall or email gateway level once identified.
• Integrate reputation-based filtering. Email gateways should leverage threat intelligence and reputation data to deprioritize or block known abusive sources automatically.
• Configure automated alerts for IT and SOC teams. Flooding attacks require immediate attention. Every minute of delay can result in thousands of unnecessary messages entering the system.

Organizational Procedures

• Develop an email flooding incident response plan. Clearly define who receives alerts, who has authority to block traffic, how employees are informed, and which alternative communication channels are activated.
• Establish backup communication channels. If corporate email becomes unavailable, critical teams (sales, finance, customer support) must know how to continue operating using alternatives such as Microsoft Teams, Slack, phone calls, or secondary email addresses.
• Regularly test response and recovery procedures. Simulate flooding scenarios in controlled environments to validate detection, escalation, and recovery timelines.

Post-Incident Actions

• Analyze attack patterns and sources. Identify how the flood was generated, which controls were effective, and whether the attack was isolated or part of a broader campaign.
• Update filtering and rate-limiting rules based on lessons learned to improve resilience against future attacks.
• Communicate transparently with employees. Explain what happened, why email was disrupted, and how to act if similar incidents occur again.

Critical Point

Email flooding is an availability attack, not a confidentiality breach. Its purpose is to disrupt operations, not steal data. Effective defense focuses on infrastructure resilience, rapid detection, and well-rehearsed recovery procedures.

For organizations where email is mission-critical to functions such as sales, customer support, or financial operations, even short periods of downtime are unacceptable. Investments in anti-flood protections and alternative communication channels should be viewed not as optional expenses, but as safeguards against operational paralysis.

5. Credential Harvesting

What It Means for Business

Credential harvesting is an attack technique aimed at stealing user credentials such as usernames, passwords, MFA tokens, or session cookies. In most cases, it is not the final objective, but the first stage of a larger security incident.

For businesses, this is one of the most dangerous email-based threats. Once credentials are compromised, attackers can operate as legitimate users, logging into systems without triggering immediate suspicion, bypassing certain controls, and gradually expanding access.

Stolen credentials are commonly used for:

• Accessing corporate email accounts.
• Executing Business Email Compromise (BEC) scenarios.
• Accessing VPNs, CRM systems, financial platforms, cloud services, and other critical business systems.
• Launching follow-on attacks, such as Ransomware.

Credential harvesting is typically delivered via phishing emails, fake login pages, QR-code phishing (quishing), malicious attachments or links that imitate legitimate authentication portals.

How to Defend Against Credential Harvesting

Effective protection requires a layered, identity-centric security model that assumes credentials will eventually be targeted.

Technical Controls

• Enforce MFA for all accounts, especially privileged users, using phishing-resistant methods where possible (hardware security keys, certificate-based authentication).
• Apply Conditional Access policies that evaluate login context, including geolocation, device posture, and behavioral risk signals (new devices, unusual login times).
• Deploy identity protection with behavioral analytics to detect anomalous sessions, rapid IP changes, token reuse, or impossible travel scenarios.
• Adopt Zero Trust principles by granting users only the minimum access required for their roles and continuously validating trust throughout sessions.

Monitoring and Early Detection

• Monitor authentication anomalies, including logins from new devices, unexpected locations, or abnormal time patterns.
• Continuously scan for indicators of account compromise, such as unusual internal activity or leaked credentials appearing in public breaches or dark web sources.
• Correlate identity events with email activity to identify phishing-to-login attack chains early.

Organizational Processes

• Define credential lifecycle management policies, including regular rotation, access reviews, and privilege audits.
• Ensure rapid account containment procedures. When compromise is suspected, accounts must be disabled or reset immediately.
• Audit third-party integrations and OAuth applications. Review which external services have delegated access, API tokens, or extended permissions and revoke unnecessary privileges.

Security Awareness and Training

• Train employees to recognize phishing login pages and fake authentication prompts.
• Educate users about the risks of password reuse and browser-stored credentials.
• Run scenario-based training focused on what to do if credentials were entered on a suspicious page, including immediate reporting and response steps.

Critical Point

Credential harvesting attacks target identity, not infrastructure. Once credentials are stolen, attackers operate within legitimate sessions, making detection significantly harder.

Because credential theft often serves as the entry point for broader compromise, defending against it requires a comprehensive approach that combines identity security, monitoring, user awareness, and rapid response capabilities.

6. QR Code Phishing (Quishing)

What It Means for Business

QR code phishing, commonly referred to as quishing, is a form of phishing attack in which threat actors use QR codes as a delivery mechanism for malicious links. Unlike traditional email phishing, where users can hover over or visually inspect a URL, a QR code obscures the destination until it is scanned.

This creates a particularly dangerous scenario for businesses. An employee may receive an email, PDF document, invoice, or internal notice containing a QR code, scan it using a corporate or personal mobile device, and be redirected to a phishing page without any prior visibility into the destination.

These phishing pages frequently impersonate:

• Authentication portals such as Microsoft 365, Google Workspace, VPNs, or HR systems.
• MFA verification or “security check” pages.
• Password reset forms or document access portals.

Quishing is especially effective in organizations that actively use mobile devices, BYOD policies, or QR codes in internal workflows such as offices, warehouses, logistics, or finance operations.

Compromised credentials obtained through quishing often become the initial access vector for further attack progression, including identity abuse (BEC), lateral movement within the environment, and ultimately disruptive outcomes such as data encryption or infrastructure compromise.

How to Defend Against Quishing

Effective protection against quishing requires a combination of email security controls, identity-centric protections, and clearly defined organizational rules around QR code usage.

Technical Controls

• Deploy email security solutions capable of detecting QR codes within email bodies and attachments and applying additional inspection to embedded content.
• Use sandboxing and dynamic URL analysis for destinations reached via QR codes, validating page behavior after user interaction rather than relying solely on static inspection.
• Restrict access to corporate resources from mobile devices through Conditional Access policies, Mobile Device Management (MDM), or Zero Trust controls.
• Enforce MFA across all critical systems to ensure that credential compromise alone does not grant immediate access.

Monitoring and Early Detection

• Monitor for anomalous authentication attempts originating from mobile browsers, newly observed devices, or unusual geolocations.
• Correlate email telemetry with identity-related events in SIEM platforms to identify phishing-to-login attack chains at an early stage.
• Track the emergence of new phishing domains impersonating corporate services, brands, or commonly used SaaS platforms.

Organizational Controls

• Define clear policies governing the use of QR codes in business processes, explicitly specifying where QR codes are permitted and where they are prohibited.
• Prohibit the use of QR codes for high-risk actions such as authentication, password changes, or financial approvals.
• Establish a rapid escalation process for employees who have scanned a suspicious QR code, including immediate session review and credential reset procedures.

Security Awareness and Training

• Train employees on a simple but critical rule: a QR code is a concealed link.
• Educate staff on common quishing indicators, including unexpected QR codes, urgency-driven messaging, and requests to “verify access” or “confirm identity.”
• Conduct dedicated quishing simulation exercises rather than limiting training to traditional email phishing scenarios.

Critical Point

Quishing demonstrates how attackers bypass traditional email filtering by exploiting trust in visual elements and mobile-first workflows. Effective defense is only possible when technical controls, process restrictions, and informed user behavior are combined into a cohesive security posture.

Email Security: Key Takeaways

1. Email is no longer just a communication channel. It represents a primary attack surface and, in many cases, the main entry point for attackers seeking to compromise identities, access sensitive information, and disrupt critical business processes.
   
2. Business Email Compromise (BEC) and credential harvesting remain the most high-impact email-based threat scenarios from a business perspective. Even when technical security controls are in place, successful exploitation is often driven by abuse of trust and weaknesses in operational processes, resulting in direct financial loss, access compromise, and operational disruption.
   
3. Technology alone is not sufficient. Even the most advanced email security solutions cannot compensate for the absence of clear verification procedures if financial transactions or other critical actions can be executed without mandatory out-of-band validation.
   
4. Effective email security starts with identity protection. Identity and Access Management (IAM), multi-factor authentication (MFA), Conditional Access policies, authentication anomaly detection, and session monitoring form the foundation for preventing credential abuse and unauthorized access.
   
5. Security effectiveness is directly influenced by employee actions in real-world scenarios. Traditional phishing awareness training is insufficient on its own. Practical value is achieved through scenario-based simulations, including BEC, QR-code phishing (quishing), and other targeted attacks aligned with real business roles and workflows.
   
6. Monitoring and correlation determine response speed. Detection of email-borne threats must be based on correlating email telemetry with identity-related events within SIEM platforms to enable early identification of compromise and controlled incident response.
   
7. Email security is an ongoing process, not a one-time project. Attack techniques evolve continuously, requiring regular review, testing, and adaptation of controls to remain aligned with the current threat landscape.

Next Steps

If email is a critical channel for business communication and operational execution, organizations should move beyond generic recommendations and assess how effectively their infrastructure, processes, and teams can detect and respond to the threat scenarios described above. This assessment must reflect real business roles, workflows, and attack paths rather than theoretical controls.

That is why Velstadt engages with organizations to evaluate their readiness for email-based threats, focusing on how well technologies, processes, and responsible roles are aligned, and whether the organization can detect and contain attack scenarios without disrupting business continuity and key operational processes.