In this article
Every significant B2B payment — a real estate closing, an M&A escrow release, a multi-party deal settlement, a commercial invoice between long-standing vendors — moves through email before it moves through a bank. That observation sounds mundane. It is, in fact, the single most important fact a financial professional needs to hold onto right now, because it describes the attack surface that has turned business email compromise into one of the most financially destructive fraud categories operating today.
The FBI's 2025 IC3 report logged 24,768 BEC complaints and $3.05 billion in reported losses, up from 21,442 complaints and $2.77 billion in 2024. Those are reported figures. Researchers consistently note that the majority of incidents go unreported, either because victims are embarrassed, because recovery seems hopeless, or because the fraud was caught after the wire landed but before the business relationship unravelled. The actual exposure is likely a multiple of the official numbers.
This article explains, with granular precision, how a man-in-the-middle attack works inside an active business email thread, what each stage looks like from the attacker's perspective, and what specifically makes the final act — the payment redirect — so devastatingly effective. It then explains why the architecture of onchain payment routing closes the attack surface at the structural level, not merely at the procedural one.
Settlement agents, title companies, closing attorneys, escrow officers, OTC desks, and commercial brokers sit at the centre of this threat. They handle the communications that authorise the largest wire transfers in their clients' lives. Understanding how the attack is constructed is the first requirement of defending against it.
FBI warning on global BEC exposure, the Arup Hong Kong case of February 2024 and the Holland & Knight lawsuit, all detailed below.
What "man-in-the-middle" actually means in an email context
The phrase comes from cryptography, where a man-in-the-middle (MitM) sits between two communicating parties and intercepts, reads, or alters the messages passing between them — without either party knowing. Business email compromise (BEC) is also known as a "man-in-the-email" attack, derived from the classic MitM concept where two parties think they are talking to each other directly, but in reality an attacker is listening in and possibly altering the communication.
The critical insight is the word silently. An attacker who announces their presence is an attacker who fails. The entire value of this technique is that the compromised thread looks and feels exactly like the legitimate conversation it replaces. What makes email hijacking particularly insidious is its subtlety: the attacker positions themselves in the middle of existing, trusted relationships. They don't need to create elaborate phishing schemes or suspicious-looking emails — they're working from inside a legitimate account, making their communications appear entirely authentic.
There are two broad variants. In the first, the attacker compromises a real mailbox belonging to one of the parties. In the second, they register a lookalike domain and spoof the appearance of a legitimate sender. Both achieve the same result. A threat actor using unauthorised access to an email account, sometimes called a man-in-the-middle attack, can be particularly hard to catch because these events allow a threat actor to hide their fraud within expected and legitimate communication.
Stage one: reconnaissance
A BEC scam starts with research. An attacker will sift through publicly available information about your company from your website, press releases, and even social media posts. They look for the names and official titles of company executives, corporate hierarchy, and even travel plans from email auto-replies.
In a deal-settlement context — a real estate transaction, a commercial M&A closing, an OTC trade — the attacker goes further. Reconnaissance typically means the attacker silently reads email traffic for two to four weeks, learning the parties' names, signature blocks, and writing styles. The combination is irresistible to attackers: large wire amounts ($200K–$2M+ on a routine basis), a thirty-to-sixty day window of email traffic across multiple parties (buyer, seller, both agents, lender, title, closing attorney), and a time-pressured wire instruction near the close.
The goal of reconnaissance is not access — access has already been established. The goal is context. The attacker needs to know what a legitimate email from this sender, to this recipient, about this transaction looks like in every detail: the salutation, the sign-off, whether the title agent writes "per our conversation" or "as discussed," whether the closing attorney uses their middle initial, what the standard subject-line format is for wire instruction emails. Every detail absorbed during reconnaissance becomes a weapon in the final strike.
Blackpoint SOC analysts have observed that one of the first signs of a brewing BEC attack is inbox rules being created maliciously to target specific keywords and redirect those emails to a folder not typically checked by the user. This is the attacker building their own monitoring dashboard inside a legitimate mailbox. Every message containing "wire," "settlement," "closing," "funds," or "instructions" is quietly copied and forwarded before the legitimate user ever sees it. Once inside the mailbox, attackers study communication patterns: who emails whom, what the standard wiring instruction format looks like, and how the sender signs off.
Stage two: gaining access or spoofing identity
Threat actors often gain access to an email account through compromised passwords. Credential phishing — a fake login page for Microsoft 365 or Google Workspace that captures username and password — is the most common initial access method. Password spraying, where an attacker tries a small set of common passwords against a large list of accounts, is the second. Malware dropped through an infected attachment completes the trio.
The attacker gains access to one party's email account, usually through credential phishing or password spraying. Title companies and real estate agents are the most common targets because they handle multiple transactions and often lack enterprise-grade email security. A single compromised mailbox gives the attacker visibility into dozens of active closings.
The second path — domain spoofing — does not require account access at all. Attackers often register domains that differ by a single character. "settlementagent.com" becomes "settlementagent.co," or the font-similar trick of substituting a lowercase L for an uppercase I. In email clients that display only the sender's name and not the full address, recipients rarely see the difference. Using lookalike domains, intimate knowledge of the communications, and pending transaction details, the attacker is able to hijack the email thread.
In the most sophisticated attacks, the attacker combines both approaches: they compromise one party's real mailbox for intelligence gathering, then communicate from a lookalike domain so that the compromised party — now also a victim — does not see outgoing messages they never sent.
In one documented case, a bad actor compromised and monitored the email system, then set up bogus domains representing each party and played both sides of the transaction so that investment funds were wired to a fraudulent account. That is exactly what happened to an Israeli startup. For each email sent to the other party, the attacker captured the email, deleted it from the corporate email system, and used their own lookalike domain email as the response. Both parties believed they were in direct contact. Neither was.
Stage three: the observation window
Once access is established and monitoring rules are in place, the attacker waits. This phase can last days or weeks. It is unhurried and methodical. An attacker who has compromised an email account silently monitors correspondence between the business and a trusted party, such as a supplier or client, learning about upcoming invoices, payment schedules, and communication patterns.
During the observation window, the attacker is building a dossier. In a real estate closing: what is the purchase price, who holds the earnest money, what is the expected wire date, who is the title agent, what bank account do the legitimate wire instructions reference, has the buyer asked any questions about payment process? In a commercial deal: who are the multiple parties receiving distributions at settlement, what are the individual amounts, which party's counsel is sending the final closing statement?
This patience is why these scams target people and process, not software. There is usually no malware and no alarm — the email looks like normal business correspondence because, to the person reading it, it is. Traditional cybersecurity tools look for anomalies: unknown file attachments, unexpected login locations, malicious URLs. A patient attacker who simply reads email and waits generates almost no signal.
Most BEC emails don't carry attachments or malicious links. They rely on plain text, carefully worded to look authentic, which means they slip past filters tuned to catch obvious threats.
Stage four: the injection — altering the payment details
This is the technical and psychological centrepiece of the attack. Everything before it was preparation. The injection is the attack itself.
At a critical moment, the attacker intercepts an invoice email, modifies the bank account details to their own, and sends it along as if nothing happened. By the time the fraud is discovered, the payment has disappeared into an untraceable account.
The timing is precise. Hours before the scheduled wire, the attacker sends modified wiring instructions. The instruction email arrives at the exact point in the thread when the recipient is expecting it — after weeks of legitimate correspondence, with the right name on the sender line, with the correct transaction reference numbers, with the correct property address or deal name, and with a tone that perfectly mirrors the legitimate party's own writing. Only the account number and routing number are different.
In some cases, the attacker may have control over the person's real email address and is therefore able to include details specific to the transaction — "I hope the home inspection went well yesterday" — to build further trust. The attacker then provides new wire instructions or specifies changes to a previous wire transfer request, such as a new account number. A false sense of urgency is created: "time is of the essence" or "this needs to go out today."
That urgency is the final psychological lever. BEC is a sophisticated, targeted cybercrime that exploits trust, human relationships, and reliance on digital communication. Sometimes referred to as "man-in-the-middle attacks," BECs are among the most financially damaging cyberattacks — they lead companies to misdirect large wire transfers to criminal actors and leave behind a messy and costly fallout, including compromised data, broken business relationships, and legal disputes with no quick or predictable resolution.
Consider a concrete scenario in commercial real estate. A buyer is acquiring a mixed-use building in a multi-party deal. The purchase price is USD 3.2 million (approximately AUD 4.9 million). The closing involves the buyer, the seller, the buyer's lender, a title company, a closing attorney, and two commercial brokers each receiving a commission at settlement. Seven parties in the thread. Seven email addresses to potentially target. The attacker has been reading the thread for nineteen days. They know the closing is scheduled for Thursday. They know the title agent's name is Sarah and that she signs off with "Best, Sarah M." They know the buyer's counsel's full signature block. On Wednesday at 4:47 PM, the attacker — operating from a domain registered as "title-horizonheights.com" rather than the real "titlehorizonheights.com" — sends the buyer's counsel an updated closing statement with revised wire instructions. The email thread context, the greeting, the sign-off, the attachment formatting: everything is correct. One routing number is different.
Acting in haste, the recipient sends the money to the attacker's account. The real party then calls late in the day or early the next morning asking about the anticipated wired funds. At that point, the attorney realises they have been scammed. The closing cannot take place, and various claims for damages accrue as a result of the failed sale, as well as a claim for the loss of the client's funds.
There are usually one or more aggrieved parties looking to the attorney for their actual damages, plus any additional attorney fees and costs incurred by all the aggrieved parties in trying to rectify the situation. Even worse, the attorney may now be exposed to professional liability claims regarding the missing funds, and may also face potential disciplinary action for the misuse or misappropriation of those funds.
Why legal and settlement professionals are disproportionately targeted
Business email compromise schemes targeting law firms are not isolated incidents; they reflect a coordinated and evolving threat landscape. As settlement values rise and digital communication accelerates, criminals continue to exploit moments of urgency and trust.
The economics are simple. BEC exploits corporate payment processes and organisational trust, which is why average losses per case are far higher than in consumer fraud. A single successful attack on a real estate closing or commercial deal settlement can yield hundreds of thousands — sometimes millions — of dollars in a single wire. The effort-to-reward ratio, from the attacker's perspective, is extraordinarily favourable.
Three factors make mortgage and settlement email traffic uniquely attractive to attackers: high-value transactions on predictable timelines. A residential mortgage closing typically involves a wire transfer between $50,000 and $500,000. Commercial closings can exceed $10 million. Attackers know these wires are coming because closing dates are public record in many jurisdictions, and the timeline creates urgency that overrides caution.
A single closing can involve the borrower, loan officer, processor, closer, title company, real estate agents on both sides, and an attorney. The attacker only needs one compromised mailbox in that chain.
The multi-party nature of deal settlement is precisely what makes it so vulnerable. Each additional party — each additional email address, each additional inbox with a different security posture, each additional human who must correctly identify a fraudulent message under time pressure — is another door. Small and medium businesses are attractive because they combine real money with informal controls. A large enterprise has separated duties, a dedicated payments team, and a formal procedure for changing supplier details. A two-attorney closing firm handling a USD 2 million (approximately AUD 3.1 million) commercial sale has neither.
The AI acceleration layer
The 2026 threat landscape is materially different from 2020. Attackers' AI tooling has elevated spoofed emails to a level where staff can no longer be expected to spot them by hand.
According to FBI reports, AI is being used to generate deepfakes, clone voices, mass-produce phishing content, and create fake social media profiles at scale. AI isn't necessarily changing the types of crimes — it's scaling them. Criminals are using AI to automate phishing campaigns, generate convincing deepfake lures, and make social engineering faster and more targeted.
Deepfakes can be used to elevate business email compromise attacks to make them even harder to spot. Instead of fake payment instructions in an email, employees can now be targeted via highly realistic video and voice calls impersonating parties or managers asking them to transfer funds.
This means the out-of-band verification step — "call the party at a known number to confirm wiring instructions before sending" — is itself under attack. When the confirming phone call produces a voice that sounds exactly like the title agent's voice, the last procedural safeguard has been neutralised. The Arup Hong Kong video-call fraud in February 2024 alone netted attackers USD 25.6 million across fifteen wire transfers, a case in which employees participated in a video call with deepfake representations of their own colleagues.
What the current defences miss
The standard recommended defences are procedural: train staff to recognise suspicious emails, require out-of-band verification for any payment detail change, implement DMARC/DKIM/SPF email authentication, enforce multi-factor authentication, and treat any bank detail change as a high-risk event requiring additional approval layers. Traditional email filters often miss these attacks because messages come from real or convincing accounts, contain no overt malicious content, and match the company's normal patterns. The most effective first line of defence is often procedural rather than technical — treat any email that changes where money goes as a high-risk request, and insist on verification by phone, video call, or another trusted channel before acting.
These defences are real. They matter. Procedural controls have prevented innumerable attacks. But they share a common failure mode: they rely on humans to perform correctly under time pressure, with incomplete information, against attackers who have studied the communication style of the legitimate parties in detail and who are now augmented by AI tools that eliminate the small tells — the grammar errors, the slightly off tone, the unfamiliar phrasing — that trained humans previously used as cues.
Email security can block or flag some attacks, but no single control covers spoofing, real-account compromise, and fraudulent business requests. Organisations need to combine email, identity, detection, finance, and awareness controls.
The deeper structural problem is this: the entire attack surface exists because the payment destination is communicated in a medium — email — that is mutable, unsecured by default, and controlled by human interpretation at the receiving end. Wire instructions travel in the body of an email message. They can be intercepted. They can be altered. They can be replaced. The attacker does not need to defeat the bank. They only need to defeat the inbox.
The structural answer: make the payment destination immutable before the deal is executed
The reason BEC attacks succeed is not that people are careless. It is that the channel carrying the payment destination — email — is fundamentally the wrong tool for that job. Email was designed for human-to-human asynchronous communication. It was not designed to carry irreversible financial instructions securely. When a closing attorney sends wire instructions by email, they are trusting that a mutable, phishable message will travel unaltered from their outbox to the recipient's inbox. That trust is the attack surface.
The structural answer is to move the payment destination out of the email thread entirely, setting it in an onchain routing contract before the deal closes — so that no message intercepted during the deal's communication phase can alter where the funds go.
This is precisely what shaka.deal is built to do. Rather than trusting a last-minute email containing a bank account number, the parties agree on the payment structure — who receives what share — before the deal is executed. That structure is encoded in an onchain routing contract on Ethereum. When the paying party triggers the settlement, the total amount is routed instantly and simultaneously to every party at the preset shares, in a single transaction. The destination addresses are already set. No email carries the final payment instruction. No attacker intercepting the email thread can alter what was committed onchain.
Each transaction is cryptographically signed and recorded in a tamper-evident ledger. Once confirmed, it cannot be altered, which eliminates the need to reconcile multiple internal ledgers and reduces the risk of fraud. The payment either exists or it doesn't, visible to everyone with access to the network.
When a blockchain transaction settles, there are no reversals or multi-day clearing windows. Money received onchain can be redeployed almost immediately.
For a settlement agent handling a multi-party commercial deal, the practical difference is significant. Under the traditional wire model, the agent must coordinate separate wire instructions for each party: seller proceeds go to one account, broker commissions to two others, lender payoff to a fourth, prorated taxes to a fifth.
| Traditional wire model | Onchain routing model | |
|---|---|---|
| Payment instructions | Separate wire instructions for each party | One transaction, one incoming payment |
| How destinations are set | Each instruction is communicated by email | Shares agreed and locked before closing day |
| Intercept points | Each instruction is a potential intercept point | No payment destination in the thread to usefully alter |
| What it depends on | Each receiving party acting correctly on a mutable message | Distribution to every party simultaneously at the locked shares |
This is not a replacement for the professional skill that settlement agents, closing attorneys, and escrow officers bring to a transaction. Those professionals structure the deal, confirm identities, manage the legal closing process, ensure title is clear, handle the compliance obligations, and coordinate the dozens of moving pieces that make a complex transaction close. What onchain routing gives them is a payment layer that does not inherit the security vulnerabilities of email communication.
Blockchains introduce a fundamentally different settlement model. Atomic settlement enforces simultaneous, conditional exchange: either both sides of a transaction execute, or neither does. Combined with rapid, economically enforced finality and 24/7 availability, this architecture eliminates a wide range of risks that regulators and market operators have long been forced to manage.
Shaka.deal is non-custodial: it routes, it never holds funds. The smart contract does not sit on top of a deal as a holding account. It is a routing layer — an immutable set of destination rules — that activates precisely when the payment arrives and distributes instantly. The settlement agent does not surrender control of the deal structure; they encode it.
Finality as a security property
One additional dimension is worth naming directly, because it is often misunderstood in the context of fraud prevention.
When a wire transfer is sent to a fraudulent account, banks are sometimes able to initiate a recall — but this depends on the receiving bank's cooperation, the speed of the report, and the jurisdiction in which the fraudulent account is held. Recovery rates are low. The FBI's IC3 operates a Financial Fraud Kill Chain programme to intercept fraudulent wires, but by the time the fraud is discovered, the money has often already been moved through multiple accounts and converted.
Onchain payment finality works differently. Once a transaction reaches finality, it is permanently etched into the immutable ledger. This concept anchors trust in decentralised systems. That finality is a security property when the destination is correct: settlement agents and their clients receive funds that are settled, not pending, not provisional, not subject to a clearing window during which the funds' status is uncertain.
For blockchain transactions, no consumer protection statute provides a reversal right: legal finality coincides with technical finality. The implication is straightforward: if the routing contract specifies the correct destination addresses — the addresses that the parties agreed to before the deal — then the payment settles to those destinations with certainty. There is no window during which an attacker can intervene in a clearing process, no provisional status that can be exploited, no instruction that can be intercepted between authorisation and settlement.
The security benefit flows from the architecture. The routing is set. The payment executes. The distribution is simultaneous and final.
A note on what this does not solve
Intellectual honesty requires naming the limits. Onchain routing removes the email-thread attack surface for payment destination manipulation. It does not prevent an attacker from compromising the deal parties' identities before the routing contract is set.
The difference is that this verification happens once, at setup, rather than being required to succeed perfectly on every individual communication in a weeks-long email thread. In the traditional model, one failed moment of vigilance on one email on one day can redirect millions. In the onchain model, the verification requirement is concentrated into a discrete setup event, after which the routing is fixed and no subsequent email can alter it.
A non-technical solution to protect against BEC and financial fraud is to require additional non-digital steps for verification before making any changes to account details, routing, or wiring information. That principle maps directly to the onchain routing approach: verify the destination addresses rigorously at setup, then rely on the immutability of the contract for every payment that follows.
Conclusion: the attack surface is the email thread itself
The FBI's IC3 data makes the scale hard to dismiss: BEC generated $3.05 billion in reported US losses in 2025, and the FBI has separately warned that global exposed losses tied to BEC passed $55 billion across the 2013–2023 reporting window.
These are not losses attributable to carelessness or unsophisticated victims. Business email compromise targeting law firms is not a hypothetical risk — Holland & Knight, one of the largest firms in the United States, was sued after someone sent $3 million to a fraudulent account. Wire fraud is not a mass phishing campaign. It is targeted, researched, and timed.
Settlement professionals, brokers, title companies, and escrow officers are doing their jobs correctly. The problem is that the communication infrastructure they depend on to convey payment destinations was never designed to bear the security requirements of an irreversible multi-hundred-thousand-dollar wire transfer. Email was designed to carry messages. The industry has asked it to carry the equivalent of a signed cheque, and attackers have learned to intercept the post.
Onchain payment routing separates those two jobs. Email carries communication. The blockchain carries the payment destination — encoded in advance, immutable once set, and executed in a single transaction that distributes to every party simultaneously with finality.
That is the architecture shaka.deal offers to settlement professionals: one payment in, preset shares out, simultaneously, with certainty. Not a replacement for the work that closing professionals do. A replacement for the most dangerous email attachment in the transaction — the wire instruction itself.
