Cybersecurity
Systems Support ยท Boston, MA
Your bookkeeper gets an email from a client asking to update bank details before Friday's wire — the sender's name is right, the tone is familiar, and no one questions it until $47,000 is gone. Business email compromise accounting firms Boston face is exactly this specific and exactly this costly, and the default email settings most firms run are not built to stop it.
Why Boston Accounting Firms Are a Primary BEC Target
Accounting and CPA firms are disproportionately targeted for BEC because every core workflow — client wire transfers, payroll runs, ACH setups, tax refund routing, and direct deposit changes — moves through email. Each is a transaction an attacker can hijack with access to the right inbox at the right moment.
The FBI's IC3 consistently identifies financial and professional services firms among the highest-loss BEC victims nationally. The concentration of IT support for accounting firms in Boston reflects how heavily the region's CPA market has sought help after recognizing this exposure. For accounting and financial services firms across the South Shore — Quincy to Hingham — the risk profile is identical: high transaction volume, deep client trust, and inboxes that never stop moving money.
The Three BEC Attack Patterns Hitting CPA Firms Right Now
Three BEC variants account for most fraud attempts against CPA firms: vendor/client impersonation, managing partner impersonation, and payroll redirect fraud. Each exploits a different workflow, but all three depend on the attacker knowing enough about your firm to sound credible.
- Vendor/client domain spoofing: The attacker registers a one-letter typo domain and sends an invoice update requesting a new ACH routing number. The thread looks familiar because they've studied prior correspondence — a staff accountant processing routine payments has no obvious reason to pause.
- CEO or managing partner impersonation: A free Gmail account bearing the partner's display name sends an urgent wire request referencing a real client just before a partner meeting. Tax season urgency makes "process this before I land" feel completely normal.
- Payroll redirect fraud: The attacker poses as a remote employee via a lookalike webmail account and submits a direct deposit change right before pay period close. Payroll administrators conditioned to process these quickly are the target.
How Attackers Get In: The Reconnaissance Phase Accounting Firms Miss
BEC is not spray-and-pray. Before sending a single fraudulent message, attackers often spend weeks inside a compromised mailbox reading threads, learning client names, billing cadences, and communication style — so the fraudulent request is nearly indistinguishable from a real one.
Accounting firms frequently run Microsoft 365 with legacy configurations, shared credentials, and no multi-factor authentication (MFA) on shared mailboxes. Those conditions make initial compromise straightforward via credential phishing (fake DocuSign or QuickBooks notifications), password reuse from a prior breach, or a compromised client forwarding an attacker's message into the firm's trusted inbox. Plymouth-area accounting firms share these same Microsoft 365 vulnerabilities — the platform and its permissive defaults are identical regardless of geography.
Five Technical Controls That Stop BEC Before It Reaches the Inbox
Five specific controls — when properly configured in Microsoft 365 — close the gaps BEC attackers depend on. Most Boston accounting firms have Microsoft 365 licenses but run default settings that leave all five off or misconfigured.
- DMARC, DKIM, and SPF: These three DNS records verify that email claiming to come from your domain actually did. Without them, anyone can send a message appearing to originate from your firm's address.
- Microsoft 365 Defender anti-phishing with impersonation protection: Flags specific individuals — senior partners, key clients — so messages impersonating them trigger alerts or are blocked. Off by default.
- Mandatory MFA on all accounts: Enforced across all mailboxes, including shared ones (frequently overlooked), so a stolen password alone is not enough to grant inbox access.
- Conditional access policies: Block logins from unexpected geographies, unmanaged devices, or outside defined hours — narrowing the window an attacker has to exploit a stolen credential.
- External email banners: A visible banner on every message from outside the firm's domain gives staff a low-friction cue to scrutinize sender addresses before acting on payment instructions.
Proper Microsoft 365 security configuration for all five controls requires deliberate setup — none ships enabled by default.
The Human Layer: Why Staff Training Is Non-Negotiable for Accounting Teams
Technical controls reduce BEC volume but don't eliminate it. BEC exploits urgency and trust — exactly what accounting staff act on during tax season, month-end close, and client deadlines — so human judgment is always part of the defense.
Scheduled phishing simulations using tools like KnowBe4 or Microsoft Attack Simulator build the habit of pausing before acting on payment instructions. A firm-wide call-back verification policy — requiring a phone call to a number from existing records before honoring any emailed payment change — is among the most effective single controls available, because it removes the attacker's ability to operate entirely through email.
What to Do If Your Firm Suspects a BEC Attempt
When a BEC attempt is suspected, speed matters above almost everything else — particularly if a wire has already been initiated. Recall windows at financial institutions are narrow and frequently close within hours.
- Do not reply to or forward the suspicious email — doing so alerts the attacker and may complicate the investigation.
- Call the apparent sender using a number from existing records, not from the suspicious email.
- Contact your bank immediately if a wire was initiated — request a recall and document the time of the call.
- Notify your IT provider to audit recent mailbox access logs and Microsoft 365 login activity.
- Document everything for potential FBI IC3 reporting and review your IT compliance obligations for Massachusetts accounting firms under Massachusetts General Law Chapter 93H.
How Systems Support Protects Boston-Area Accounting Firms From BEC
Systems Support deploys and manages the controls described here — DMARC configuration, Microsoft 365 Defender policy setup, MFA enforcement, and staff phishing simulations — as part of its cybersecurity services for Boston-area businesses, with a focus on accounting and financial services firms across the South Shore.
A 15-minute discovery call is the right starting point — we'll review your Microsoft 365 configuration and identify the specific gaps that leave your firm exposed to business email compromise accounting firms Boston face every day.
Frequently Asked Questions
What is business email compromise and how does it target accounting firms?
Business email compromise is a fraud scheme in which an attacker impersonates a trusted party via email to redirect payments or steal data. Accounting firms are targeted because their core workflows — wire transfers, ACH setups, payroll runs, and tax refund routing — all run through email, giving attackers multiple entry points.
How can I tell if an email requesting a wire transfer is legitimate or a BEC scam?
You often cannot tell from the email alone — BEC messages are designed to closely mimic legitimate requests. The safest policy is call-back verification: before acting on any emailed payment instruction or bank account change, call the sender at a number from your existing records, never from a number in the email itself.
Does Microsoft 365 protect my accounting firm from business email compromise by default?
No. Microsoft 365's default settings leave DMARC authentication, impersonation protection, MFA on shared mailboxes, and conditional access controls off or misconfigured. These protections must be deliberately enabled — they do not ship active for most small accounting firms.
What should a CPA firm do immediately after a suspected BEC attack?
Do not reply to the suspicious email. Call the sender using a number from existing records. If a wire was sent, contact your bank immediately to request a recall — windows close fast. Notify your IT provider to audit mailbox access logs, and document everything for potential FBI IC3 and Massachusetts AG reporting.
Find Out If Your Accounting Firm's Email Security Can Stop a BEC Attack
In a free 15-minute discovery call, our team will review your current Microsoft 365 configuration, identify the specific email authentication gaps attackers look for, and show you exactly what it would take to close them.
Book Your Free Discovery Call
