AegisAI Perspectives · 043
Attackers choose recipients by the payment, account or access each role controls, so defenders guard those roles first and check requests against history.
Role-based email threat targeting is attackers choosing recipients by what their job can authorise, such as paying suppliers or changing account details. It matters because reported business email compromise losses reached $3,046,598,558 in 20251. AegisAI reads each request against what the sender has sent before, so a message aimed at a payment role is judged on what it asks for.
The FBI counted 24,768 business email compromise complaints in 20252. Its definition names the targets by function: businesses working with suppliers or regularly performing wire transfer payments3. How attackers pick individual victims is covered in The Bullseye Report on criminal account-based marketing. This page covers the role mechanism and the signals a defender can read.
Start from what each role can authorise, then protect those accounts first. Microsoft's guidance says phishing that casts a random net is inefficient for attackers, while spear phishing or whaling aimed at priority accounts is very rewarding8.
List the accounts worth taking over. Microsoft names CEOs, CISOs, CFOs, infrastructure admin accounts and build system accounts as priority accounts7.
Tag up to 250 of them as priority accounts in the Microsoft 365 admin center11. The Priority accounts page finds users by name, job title or distribution list12.
Add the people who act for them. Microsoft advises protecting users with access to a protected mailbox, such as the CEO's executive assistant14.
Require multifactor authentication and disable legacy authentication protocols on those accounts9.
Add executive names to user impersonation protection, up to 350 users per anti-phishing policy15. Keep mailbox intelligence on, which learns each user's email patterns with frequent contacts17.
In Google Workspace, turn on Protect against spoofing of employee names20. Change its action from the default, which keeps the email in the inbox with a warning, to spam or quarantine21.
Set one rule for finance and HR. Any request to change account details is confirmed through a second channel, as the FBI recommends5.
AegisAI agents check every payment request against the sender's history22. They read the thread the way an analyst would, covering the sender's history, the change being asked for and where the reply actually goes. When a supplier's real account is compromised, authentication passes, so the verdict rests on what this sender has sent you before and on the request itself. The patterns covered are thread hijacking, look-alike domains, bank-detail changes, and CEO and payroll fraud. Every verdict arrives with the evidence.
Each role has a different action worth faking, so each leaves a different trace. Check the signal before the authentication result, because a lookalike domain with valid DNS records can pass sender authentication checks18.
| Role | What it can authorise | Lure in the sources | Signal or control to check |
|---|---|---|---|
| Finance and accounts payable | Supplier payments and wire transfers | A bank-detail change on an open invoice | First payment change in the sender's history |
| Executives | Instructions that staff act on | An email in the CEO's name asking for a wire4 | A known display name on an unfamiliar address16 |
| HR and payroll | Direct deposit changes and personal data | An "employee" changing direct deposit | A directory name on mail from outside your domain |
| IT and infrastructure admins | Tenant and build system access | Not stated in the sources used here | Multifactor authentication on, legacy protocols off |
| Assistants with mailbox access | Acting for the executive | Not stated in the sources used here | First contact from a sender19 |
Illustrative example, figures are fictional. A 1,400 person manufacturer tags 38 priority accounts, including two accounts payable clerks and the CFO's assistant. One clerk receives a reply inside a real supplier thread of 160 messages. It asks her to pay invoice 7731 ($48,200) to a new bank account before Friday. Sender authentication passes, because the supplier's mailbox was taken over. Three signals stand out. This is the first payment change in 160 messages. The reply-to address sits on a domain registered nine days earlier. The deadline falls on an open invoice. The clerk calls the supplier on the number in the vendor file, and the supplier confirms it sent no change.
It is the choice of a recipient by job function and the authority that job carries. The FBI's definition describes the pattern: scams aimed at people working with suppliers or regularly performing wire transfer payments, run through compromised email accounts. The attacker needs one role that can move money or data, so a short list of recipients is enough.
Shared role addresses such as billing@ or payroll@ are one place these requests land. Behind either kind of address, the attacker picks the mailbox that can act on the request.
Attackers impersonate executives and send the request to the employee who can carry it out. The FBI notes that chat generators can quickly write official sounding emails that mimic a company's CEO or other officials. User impersonation pairs a real person's display name with a different email address.
Microsoft's priority account protection applies separate heuristics to executives, because their mail flow patterns differ from the average user13. The same guidance extends protection to an executive's assistant. The person who acts on the request is part of the target.
The sources used here describe two: a changed bank account on a real invoice, and a wire request in an executive's name. The FBI's definition centres business email compromise on supplier relationships and wire transfer payments. Reported losses in 2025 were $3,046,598,558.
A hijacked supplier mailbox passes authentication, so the check has to sit on the request itself. The FBI recommends verifying requests to change account information through secondary channels or two factor authentication. The full control list for finance is in How to prevent business email compromise.
They aim for access. Microsoft names CISOs as priority accounts, along with infrastructure admin accounts and build system accounts, because of the sensitive information they reach. A harvested admin password gives the attacker that admin's access.
The FBI advises against supplying login credentials by email6. For these roles, sign-in controls come first. Turn multifactor authentication on and legacy authentication protocols off.
HR holds payroll and personal data, so the lure asks for one or the other. Payroll fraud arrives as an "employee" asking to change direct deposit. The FBI warns that many emails requesting personally identifiable information may appear legitimate, and advises against sending it by email.
Gmail's employee name protection flags mail that carries a directory name from outside your domain. For legal teams, the duties that apply to client email are set out in What does email security for law firms need to cover? The sources used here give no legal specific attack figure.
Strategies that learn each mailbox's normal contacts and each sender's history fit this mail, because a lookalike domain can pass authentication. Mailbox intelligence uses AI to learn user email patterns with frequent contacts. Priority account protection adds heuristics tailored to executives' mail flow.
Checking a payment request against the sender's history covers the case where the real supplier account is compromised. AI also works for attackers. Businesses reported over $30 million in 2025 losses to business email compromise involving AI. A comparison of models and rules for this class of mail is in Which catches payloadless BEC: an AI model or a rule?
Track three numbers and where each lives.
One role can authorise the loss. Business email compromise, which the FBI defines around supplier and wire transfer payments, cost $3,046,598,558 in reported losses in 2025. Protecting the roles that can pay, change accounts or grant access puts controls where the request lands.
Not on their own. Impersonation from a lookalike domain with valid DNS records passes all three. A real supplier account that was taken over also passes, so the check moves to the sender's history and the request.
Up to 250. Separately, each Defender for Office 365 anti-phishing policy protects up to 350 users from user impersonation. Tag the roles that can pay, change accounts or administer systems first.
No. A shared role address is one delivery point. Role-based targeting is the choice of recipient by authority, whether the request lands in billing@ or in a named clerk's inbox.
It lowers the cost of a convincing pretext. The FBI says chat generators can quickly write official sounding emails that mimic a CEO, and businesses reported over $30 million in 2025 losses to business email compromise involving AI.
Confirm it through a second channel before acting. The FBI recommends secondary channels or two factor authentication for requests to change account information. Use a phone number already on file, never one taken from the email.
