---
title: "Business Email Compromise in NZ: Protecting you from rising attacks"
description: Learn how Business Email Compromise is targeting Microsoft 365 users in NZ. Discover why SMEs are vulnerable, the risks, and how NSP helps prevent attacks.
image: https://blog.nsp.co.nz/hubfs/BEC%20-%20NZ%20SMEs%20be%20aware.png
---
[](https://nsp.co.nz/)
- [Home](https://nsp.co.nz/)
- Solution
##### [Cybersecurity](https://nsp.co.nz/cybersecurity/)
- [Incident Response](https://nsp.co.nz/cybersecurity/incident-response/)
- [Penetration testing (pen tests)](https://nsp.co.nz/cybersecurity/penetration-testing/)
- [Security Assessments](https://nsp.co.nz/cybersecurity/cyber-security-assessments/)
- [Secure Email](https://nsp.co.nz/cybersecurity/secure-email-services/)
- [Security Awareness](https://nsp.co.nz/cybersecurity/cyber-security-awareness-training/)
- [Security Operations Centre](https://nsp.co.nz/cybersecurity/security-operations-centre/)
- [VCISO Strategy Services](https://nsp.co.nz/cybersecurity/vciso-strategy-services/)
- [Cyber Insurance Assessments](https://nsp.co.nz/cybersecurity/cyber-insurance-assessments/)
- [Vulnerability Management](https://nsp.co.nz/cybersecurity/vulnerability-management/)
- [Ransomware Protection & Recovery](https://nsp.co.nz/cybersecurity/ransomware-protection-and-recovery/)
- [Tabletop Exercise](https://nsp.co.nz/tabletop-exercise/)
##### [Modern Workplace](https://nsp.co.nz/modern-workplace/)
- [AI Governance & Compliance](https://nsp.co.nz/modern-workplace/ai-governance-compliance/)
- [Remote Workforce](https://nsp.co.nz/modern-workplace/remote-workforce/)
- [Microsoft Co-Pilot](https://nsp.co.nz/modern-workplace/microsoft-365-co-pilot/)
- [Consultation](https://nsp.co.nz/modern-workplace/consultation/)
- [Productivity & Innovation](https://nsp.co.nz/modern-workplace/productivity-and-innovation/)
- [Business Intelligence](https://nsp.co.nz/modern-workplace/business-intelligence/)
- [Security](https://nsp.co.nz/modern-workplace/security/)
##### [Cloud](https://nsp.co.nz/cloud/)
- [Managed Services](https://nsp.co.nz/cloud/managed-services/)
- [Migration](https://nsp.co.nz/cloud/migration/)
- [Storage](https://nsp.co.nz/cloud/storage/)
- [PBX/Voice](https://nsp.co.nz/cloud/pbx-voice/)
- [Security](https://nsp.co.nz/cloud/security/)
##### [Managed Services](https://nsp.co.nz/managed-services/)
- [Managed IT](https://nsp.co.nz/cloud/managed-it/)
- [Helpdesk](https://nsp.co.nz/managed-services/helpdesk/)
- [Business Intelligence](https://nsp.co.nz/managed-services/business-intelligence/)
- [Business Innovation](https://nsp.co.nz/managed-services/business-innovation/)
- [Managed Network](https://nsp.co.nz/managed-services/managed-network/)
##### [Network Performance](https://nsp.co.nz/network-performance/)
- [Firewall as a Service](https://nsp.co.nz/network-performance/firewall-as-a-service/)
- [Network Intelligence](https://nsp.co.nz/network-performance/network-intelligence/)
- [Network Roadmaps](https://nsp.co.nz/network-performance/network-roadmaps/)
##### [Backup](https://nsp.co.nz/backup/)
- [Data Backup](https://nsp.co.nz/backup/data-backup/)
- [Data Consultancy](https://nsp.co.nz/backup/data-consultancy/)
- [Data Retention Solutions](https://nsp.co.nz/backup/data-retention-solutions/)
- [Cloud Storage](https://nsp.co.nz/backup/cloud-storage/)
- [Ransomware Protection & Recovery](https://nsp.co.nz/backup/ransomware-protection-and-recovery/)
##### [Professional Services](https://nsp.co.nz/professional-services/)
- [Services](https://nsp.co.nz/professional-services/services/)
- [Consultancy](https://nsp.co.nz/professional-services/consultancy/)
- [Project Delivery](https://nsp.co.nz/professional-services/project-delivery/)
##### [Cybersecurity](https://nsp.co.nz/cybersecurity/)
- [Incident Response](https://nsp.co.nz/cybersecurity/incident-response/)
- [Penetration testing (pen tests)](https://nsp.co.nz/cybersecurity/penetration-testing/)
- [Security Assessments](https://nsp.co.nz/cybersecurity/cyber-security-assessments/)
- [Secure Email](https://nsp.co.nz/cybersecurity/secure-email-services/)
- [Security Awareness](https://nsp.co.nz/cybersecurity/cyber-security-awareness-training/)
- [Security Operations Centre](https://nsp.co.nz/cybersecurity/security-operations-centre/)
- [VCISO Strategy Services](https://nsp.co.nz/cybersecurity/vciso-strategy-services/)
- [Cyber Insurance Assessments](https://nsp.co.nz/cybersecurity/cyber-insurance-assessments/)
- [Vulnerability Management](https://nsp.co.nz/cybersecurity/vulnerability-management/)
- [Ransomware Protection & Recovery](https://nsp.co.nz/cybersecurity/ransomware-protection-and-recovery/)
- [Tabletop Exercise](https://nsp.co.nz/tabletop-exercise/)
##### [Modern Workplace](https://nsp.co.nz/modern-workplace/)
- [AI Governance & Compliance](https://nsp.co.nz/modern-workplace/ai-governance-compliance/)
- [Remote Workforce](https://nsp.co.nz/modern-workplace/remote-workforce/)
- [Microsoft Co-Pilot](https://nsp.co.nz/modern-workplace/microsoft-365-co-pilot/)
- [Consultation](https://nsp.co.nz/modern-workplace/consultation/)
- [Productivity & Innovation](https://nsp.co.nz/modern-workplace/productivity-and-innovation/)
- [Business Intelligence](https://nsp.co.nz/modern-workplace/business-intelligence/)
- [Security](https://nsp.co.nz/modern-workplace/security/)
##### [Cloud](https://nsp.co.nz/cloud/)
- [Managed Services](https://nsp.co.nz/cloud/managed-services/)
- [Migration](https://nsp.co.nz/cloud/migration/)
- [Storage](https://nsp.co.nz/cloud/storage/)
- [PBX/Voice](https://nsp.co.nz/cloud/pbx-voice/)
- [Security](https://nsp.co.nz/cloud/security/)
##### [Managed Services](https://nsp.co.nz/managed-services/)
- [Managed IT](https://nsp.co.nz/cloud/managed-it/)
- [Helpdesk](https://nsp.co.nz/managed-services/helpdesk/)
- [Business Intelligence](https://nsp.co.nz/managed-services/business-intelligence/)
- [Business Innovation](https://nsp.co.nz/managed-services/business-innovation/)
- [Managed Network](https://nsp.co.nz/managed-services/managed-network/)
##### [Network Performance](https://nsp.co.nz/network-performance/)
- [Firewall as a Service](https://nsp.co.nz/network-performance/firewall-as-a-service/)
- [Network Intelligence](https://nsp.co.nz/network-performance/network-intelligence/)
- [Network Roadmaps](https://nsp.co.nz/network-performance/network-roadmaps/)
##### [Backup](https://nsp.co.nz/backup/)
- [Data Backup](https://nsp.co.nz/backup/data-backup/)
- [Data Consultancy](https://nsp.co.nz/backup/data-consultancy/)
- [Data Retention Solutions](https://nsp.co.nz/backup/data-retention-solutions/)
- [Cloud Storage](https://nsp.co.nz/backup/cloud-storage/)
- [Ransomware Protection & Recovery](https://nsp.co.nz/backup/ransomware-protection-and-recovery/)
##### [Professional Services](https://nsp.co.nz/professional-services/)
- [Services](https://nsp.co.nz/professional-services/services/)
- [Consultancy](https://nsp.co.nz/professional-services/consultancy/)
- [Project Delivery](https://nsp.co.nz/professional-services/project-delivery/)
- [About us](https://nsp.co.nz/about-us/)
- Resources
- [Blog](https://blog.nsp.co.nz/)
- [Webinar](https://nsp.co.nz/webinar/)
- [Blog](https://blog.nsp.co.nz/)
- [Webinar](https://nsp.co.nz/webinar/)
- [Contact us](https://nsp.co.nz/contact-us/)
[0508 010 101](tel:0508%20010%20101)[hello@nsp.co.nz](mailto:hello@nsp.co.nz)
- Home
- Blogs
- Business Email Compromise in NZ: Protecting you...
### Business Email Compromise in NZ: Protecting you from rising attacks
Dayna-Jean Broeders
19 August 2025
6 min
Read
# **Business Email Compromise: The Cyber Threat Hitting NZ Businesses Hard**
Cyberattacks in New Zealand are on the rise and NSP has seen first-hand how quickly they can devastate a business. One of the fastest-growing and most damaging attack methods right now is [Business Email Compromise (BEC)](https://www.microsoft.com/en-us/security/business/security-101/what-is-business-email-compromise-bec), and Microsoft 365 users are firmly in the crosshairs.
## **What’s Happening**
Cybercriminals are breaking into legitimate [Microsoft 365 business email accounts](https://www.scworld.com/news/microsoft-365-environments-exploited-in-business-email-attacks) and using them to send phishing emails. These often look like **genuine shared files or collaboration invites** from trusted colleagues or partners.
Because the messages come from a **real, compromised account**, recipients are less likely to question them and more likely to click malicious links or open infected attachments.
## **How BEC Works**
Once attackers gain access to an email account, they can:
- **Impersonate trusted users** - tricking staff, clients, or suppliers into action.
- **Harvest [login credentials](https://www.techradar.com/pro/security/your-employee-logins-are-more-valuable-to-criminals-than-ever-heres-how-to-keep-them-protected)** - capturing usernames and passwords for further attacks.
- **Steal sensitive data** - from financials to client information.
- **Deliver malware or ransomware** - using legitimate-looking attachments.
- **Manipulate payments or invoices** - redirecting funds without raising alarms.
These attacks are **stealthy, effective, and [increasingly common in New Zealand](https://www.ncsc.govt.nz/news/businesses-in-aotearoa-need-to-prioritise-cyber-security/)**.
Slide below to see what you *could expect* to see when encountering BEC:
## **Why This Is So Dangerous**
Traditional warning signs, like strange email addresses or poor grammar, don’t always apply here. Messages appear to come from **trusted, known senders**, often referencing real projects or conversations.
That means **antivirus alone isn’t enough**. Without layered defences and an informed workforce, even the most security-conscious businesses can fall victim.
## **What You Can Do to Protect Your Business**
Here are practical steps your team should take right now:
- **Pause before clicking.** Always be cautious with unexpected file-sharing emails, even from known contacts. When in doubt, call and verify.
- **Check the link.** Hover over file-sharing links to confirm they are legitimate.
- **Verify Microsoft login pages.** Only enter credentials on URLs that come from Microsoft domains. *(See the full list of official Microsoft domains [here](https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide)).*
- **Enable Multi-Factor Authentication (MFA).** A critical safeguard if credentials are stolen.
- **Use advanced email security tools.** Filtering and threat detection add another layer of defence.
- **Report suspicious messages.** Never ignore a potential threat, escalate it to your IT team or provider immediately.
## **The Bigger Picture**
According to New Zealand’s [National Cyber Security Centre](https://securitybrief.co.nz/story/nz-cyber-incidents-cause-nzd-7-8-million-loss-in-early-2025), the cost of cybercrime against local businesses continues to climb each quarter. For SMEs, the risk is even higher: attackers know these organisations often lack enterprise-scale defences.
BEC attacks thrive on **trust**, exploiting human behaviour as much as technical systems. That’s why prevention requires a mix of:
- **Technology** (MFA, filtering, monitoring)
- **Processes** (verification, reporting)
- **Awareness training** (so staff recognise red flags before damage is done).
## **How NSP Can Help**
At NSP, we work with New Zealand businesses every day to strengthen cyber resilience. With:
- [Awareness training](https://nsp.co.nz/cybersecurity/cyber-security-awareness-training/) through industry-leading platforms like KnowBe4,
- [Advanced threat detection](https://nsp.co.nz/cybersecurity/) to stop attacks before they spread,
- [Security reviews](https://nsp.co.nz/cybersecurity/cyber-security-assessments/) to identify and close gaps in Microsoft 365 setups,
- **24/7 monitoring** through our SOC ([Security Operations Centre](https://nsp.co.nz/cybersecurity/security-operations-centre/)).
We make sure you’re not just reacting to attacks, but staying a step ahead.
## **Final Word**
If a cybercriminal compromised your Microsoft 365 account today, would your business notice in time?
With [Business Email Compromise](https://www.eftsure.com/statistics/business-email-compromise-statistics/) rising sharply across New Zealand, the difference between resilience and risk is action.
Contact NSP today to review your defences and protect your business from becoming the next statistic.
## **Frequently Asked Questions: Business Email Compromise in NZ**
### **1. What is Business Email Compromise (BEC)?**
BEC is when attackers compromise a legitimate business email account and use it to trick others into sharing sensitive data, making payments, or clicking malicious links.
### **2. Why are Microsoft 365 users a common target?**
Because Microsoft 365 is widely used in New Zealand, attackers know compromising these accounts gives them access to trusted communication channels and sensitive business data.
### **3. How can I tell if an email is fake if it comes from a real account?**
Look for unusual requests, look at the URL, unexpected file shares, or urgent language. Always verify directly by phone or in person before acting.
### **4. Is Multi-Factor Authentication (MFA) enough to stop BEC?**
MFA significantly reduces risk, but attackers may still trick staff into clicking or sharing information. That’s why MFA must be combined with training and monitoring.
### **5. What should I do if I suspect my account has been compromised?**
Immediately reset your password, notify your IT team or MSP, enable MFA, and review account activity for signs of further compromise.
[Review your defences and protect your business](https://go.nsp.co.nz/cybersecurity-consultation)
#### CATEGORY
- [Cybersecurity (94)](https://blog.nsp.co.nz/tag/cybersecurity)
- [Digital transformation (37)](https://blog.nsp.co.nz/tag/digital-transformation)
- [Managed services (33)](https://blog.nsp.co.nz/tag/managed-services)
- [Awareness and education (23)](https://blog.nsp.co.nz/tag/awareness-and-education)
- [Cloud (23)](https://blog.nsp.co.nz/tag/cloud)
- [AI (20)](https://blog.nsp.co.nz/tag/ai)
- [Breach (17)](https://blog.nsp.co.nz/tag/breach)
- [IT Risk (17)](https://blog.nsp.co.nz/tag/it-risk)
- [modern workplace (12)](https://blog.nsp.co.nz/tag/modern-workplace)
- [Collaboration (11)](https://blog.nsp.co.nz/tag/collaboration)
- [Cyber Smart Week (11)](https://blog.nsp.co.nz/tag/cyber-smart-week)
- [Business strategy (9)](https://blog.nsp.co.nz/tag/business-strategy)
- [Culture (9)](https://blog.nsp.co.nz/tag/culture)
- [microsoft (9)](https://blog.nsp.co.nz/tag/microsoft)
- [Backup (8)](https://blog.nsp.co.nz/tag/backup)
- [Remote Workers (8)](https://blog.nsp.co.nz/tag/remote-workers)
- [copilot (7)](https://blog.nsp.co.nz/tag/copilot)
- [Cyber Insurance (6)](https://blog.nsp.co.nz/tag/cyber-insurance)
- [Future of work (6)](https://blog.nsp.co.nz/tag/future-of-work)
- [Managed Detection & Response (MDR) (6)](https://blog.nsp.co.nz/tag/managed-detection-response-mdr)
- [network performance (6)](https://blog.nsp.co.nz/tag/network-performance)
- [Vulnerability Assessment (5)](https://blog.nsp.co.nz/tag/vulnerability-assessment)
- [Microsoft Teams (4)](https://blog.nsp.co.nz/tag/microsoft-teams)
- [vCISO (4)](https://blog.nsp.co.nz/tag/vciso)
- [0365 (3)](https://blog.nsp.co.nz/tag/0365)
- [Governance (3)](https://blog.nsp.co.nz/tag/governance)
- [IT budget (3)](https://blog.nsp.co.nz/tag/it-budget)
- [Legal Industry (3)](https://blog.nsp.co.nz/tag/legal-industry)
- [Best Practice (2)](https://blog.nsp.co.nz/tag/best-practice)
- [Construction Industry (2)](https://blog.nsp.co.nz/tag/construction-industry)
- [Penetration Testing (2)](https://blog.nsp.co.nz/tag/penetration-testing)
- [Tabletop Exercise (2)](https://blog.nsp.co.nz/tag/tabletop-exercise)
- [health IT consultant (2)](https://blog.nsp.co.nz/tag/health-it-consultant)
- [Healthcare (1)](https://blog.nsp.co.nz/tag/healthcare)
see all
#### RECENT POST
[.webp)](https://blog.nsp.co.nz/nz-cyber-breaches-september-2026-what-to-do-next)
[3 NZ Cyber Breaches in 1 Week: What Every NZ Business Should Do | NSP](https://blog.nsp.co.nz/nz-cyber-breaches-september-2026-what-to-do-next)
14 Sept 2026
[](https://blog.nsp.co.nz/microsoft-365-security-drift-nz-business)
[Microsoft 365 Security Drift: What NZ Businesses Should Know | NS](https://blog.nsp.co.nz/microsoft-365-security-drift-nz-business)
13 Sept 2026
[](https://blog.nsp.co.nz/copilot-data-access-permissions-nz-business)
[What Can Your Staff See? The AI Question for NZ Businesses | NSP](https://blog.nsp.co.nz/copilot-data-access-permissions-nz-business)
08 Sept 2026
[](https://blog.nsp.co.nz/nz-businesses-adopting-ai-before-ready)
[Why NZ Businesses Are Adopting AI Before They're Ready | NSP](https://blog.nsp.co.nz/nz-businesses-adopting-ai-before-ready)
16 Aug 2026
### Let’s stay in touch!
Enter your details below to stay up-to-date with the latest IT solutions and security measures.
[](https://nsp.co.nz/)
A trusted technology partner for NZ SMEs. Building secure, scalable technology solutions for more than 20 years
##### Useful Links
- [About us](https://nsp.co.nz/about-us/)
- [Procurement](https://savvi.net.nz/)
- [Cybersecurity](https://nsp.co.nz/cybersecurity/)
- [Managed Services](https://nsp.co.nz/managed-services/)
- [Cloud](https://nsp.co.nz/cloud/)
- [Contact us](https://nsp.co.nz/contact-us/)
##### Contact
Unit 1, 13 Farnham Street Parnell, Auckland 1052, NZ
- [0508 010 101](tele:0508%20010%20101)
- [info@nsp.co.nz](mailto:info@nsp.co.nz)
-
-
-
Copyright © 2026 NSP - All rights reserved
- [Terms & Conditions](https://blog.nsp.co.nz/hubfs/NSP%20Terms%20and%20conditions/NSP%20Terms%20%26%20Conditions%202021.pdf)
- [Privacy Policy](https://nsp.co.nz/privacy-policy/)
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Dayna-Jean Broeders",
"url" : "https://blog.nsp.co.nz/author/dayna-jean-broeders"
},
"dateModified" : "2026-06-16T03:38:16.029Z",
"datePublished" : "2025-08-19T20:05:54.000Z",
"headline" : "Business Email Compromise in NZ: Protecting you from rising attacks",
"image" : [ "https://blog.nsp.co.nz/hubfs/BEC%20-%20NZ%20SMEs%20be%20aware.png" ],
"mainEntityOfPage" : {
"@id" : "https://blog.nsp.co.nz/business-email-compromise-in-nz-protecting-you-from-rising-attacks",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.nsp.co.nz/hubfs/NSP_Logo_Primary%20logo_CMYK_1.png"
},
"name" : "Network Service Providers Ltd"
}
}
```