It's Not If You'll Face a Cyber Incident, It's When

Here’s how it usually starts.

An email comes in from a supplier you’ve worked with for years. Same name, same signature block, same friendly tone. They’ve changed banks, it says, and could you update the account number before the next payment goes out?

Nothing about it looks wrong. That’s the problem. The clumsy fraud email, the one with the misspellings you were taught to delete on sight, is no longer the one to plan for. What shows up now reads clean, knows your supplier’s name, and sometimes knows the invoice number. Some of that is AI doing what it does best: writing fluent, personal, correct-sounding text at almost no cost. The people who send these emails use the same tools you do.

A cyber incident is the formal phrase for what happens next. In plain words: somebody got into your email, your bank login, or your files, or locked you out of them, and now money or information is moving where it shouldn’t, or the business is stopped until the systems come back.

Last week we looked at what your business was worth. This week is about the same systems on a worse morning. What would still work the day after somebody got into your email?

”We’re Too Small for Anyone to Bother With”

That’s the sentence I usually hear when this comes up, and I understand it. The breaches that make the news are banks and airlines. Nobody writes a headline about a twelve-person company that wired one payment to the wrong account.

But look at it from the other side of the email. Some of these are sent in bulk, ten thousand at a time, because sending costs nothing. Some are researched for weeks, down to which employee pays the bills and which suppliers invoice monthly. Either way, the business that pays is the one where money moves on an email request alone, and the business that doesn’t is the one where somebody has to look first.

The FBI’s Internet Crime Complaint Center logged nearly 25,000 complaints of business email compromise in 2025, with reported losses of about $3 billion, according to its 2025 Internet Crime Report (ic3.gov). That whole category is fraud that arrives as email, usually aimed at whoever handles the payments. And those are just the ones that got reported.

So the honest planning assumption is the title of this issue. At some point, somebody will try yours. What you can control is what they find when they do.

This Is a Controls Question Before It’s a Computer Question

I’m not a security consultant. That’s my first statement, and if your business runs on specialized systems, you want a real one looking at them.

But most of these losses don’t start with somebody breaking the computers. They start with somebody asking politely for money, and the payment process saying yes. That part, the controls around the money, is the part I’ve spent my career on.

There are preventive controls, and there are detective controls. Preventive controls are the policies you put in place to set things up to succeed. The detective ones are on the back side: reviewing the bank reconciliation, making sure the coding is right. I’m the detective.

Years ago, when I was a controller, a bank reconciliation turned up a check from one of our locations that I couldn’t place. I didn’t recognize the vendor, and the signature on the check didn’t look authentic. There had never been an issue at that location, and the bookkeeper there was a respected and trusted person in the company and in the community.

I went to the location and sat down with her, one-on-one. She broke down in tears and told me what happened. Her boyfriend planned the whole thing; they were desperate for money, and she couldn’t say no, even though she knew it was wrong.

We got the money back from the bank. I had to let her go, and she lost her good reputation in the community and with her coworkers. The lesson has stayed with me ever since: anybody is capable of succumbing to the temptation of theft, given the right circumstances and the opportunity. Nobody wants to run these checks on people they trust, which is exactly why they have to be routine. The controls protect everybody, the person doing the work included.

The email version of the temptation is newer than that check was, but the controls that catch it are the same principle. A fraud that makes it past the inbox still has to make it past the controls before it reaches the cash. The inbox belongs to the whole internet. The controls belong to you.

Five Things to Have in Place Before December

Why December? Because the last weeks of the year are when the most money moves through most businesses: year-end payments, bonuses, deposits on next year’s work. People are in a hurry, people are out, and somebody new is covering the inbox. A fake payment request works best in exactly that kind of week.

These five are not a complete security plan. They are the controls I’d want in place first. Four of them cost nothing but an afternoon; the restore test assumes you already have a backup, and if you don’t, that’s today’s first call to whoever runs your IT.

1. The callback rule. Any email that changes where money goes gets a phone call before anything else happens: a new account number, a new payee, an urgent request to pay today. Call the supplier at the number you already had on file, never at a number in the email. The whole fraud depends on the email being the only channel, and one call closes it. It costs you nothing. It’s just doing it differently so that you’re protected, and the people doing the work are protected.

2. Two sets of eyes above a line. Pick a dollar amount. Above it, no payment moves on one person’s say-so, including yours. A common version of this fraud is an email that looks like it came from you, telling whoever pays your bills to send money somewhere today. The second approval protects them from your own email address. Everybody wins, because everybody knows what the system is.

3. Know who can get in. Write down everyone who can sign in to your email, the bank, the payroll service, and the books. Anyone on that list who no longer works for you comes off today. Then turn on two-step sign-in, the code that goes to a phone, on your email first and the bank right behind it: the fraud in the opening works best from inside a real mailbox, and the code is what keeps a stolen password from being enough by itself. It costs about four seconds per sign-in.

4. Test the restore, not the backup. Almost everybody has a backup. Very few people have watched one come back. Pick a quiet afternoon, have whoever runs your systems restore one real file from last week, and open it. A backup prevents nothing on its own; it’s what you recover with after a bad morning. The restore test is how you find out on a calm Tuesday, instead of the worst morning of the year, whether the recovery is really there.

5. Write the first hour down. On paper: who calls the bank to freeze the account, who calls your insurance agent, who calls whoever runs your computers, and the phone number for each. Keep a printed copy at the office and one somewhere else, because a plan that lives only on the server is part of what you might lose. And if nothing else, you’ll have a list for your insurance agent, who is going to ask what you had in place.

The Two-Minute Slot That Keeps It Working

A list like this has one weakness, and it isn’t the items. The hard part isn’t writing the list. It’s keeping the list alive after the first week, and the only thing I’ve seen keep any control alive is a standing place in the weekly rhythm.

So give it two minutes in your weekly leadership meeting. Three questions, same order every week. Did anyone get a payment-change request this week? Did anyone new get access to anything? When was our last restore test? Most weeks, that takes two minutes, and nothing comes of it. The week something odd showed up in the inbox, that protection is where somebody says so out loud.

If your weekly meeting doesn’t have a place where standing items like this live, the free 60-Minute Meeting Agenda worksheet gives you one:

alinement.com/brief/tools/sixty-minute-agenda

One Final Thought

None of this makes hacking preventable. Nothing does, which is what the title of this issue means. What these five things change is the morning after: the fake invoice that got a callback instead of a payment, the password that wasn’t enough by itself, the files that came back from a backup you had already watched work.

You’ve already done harder things than this to protect the business. You lock the building, and you carry insurance. This is the same instinct, directed at the inbox. It’s not complicated.

I’m curious: of the five, which one is already in place at your company, and which one is furthest away?

I’d welcome your thoughts.

P.S. Next week stays on the year-end theme: six questions to ask about your books before December, so the answers come from you instead of surprising you in the spring.

And if you’re an advisor working with owner-led businesses, visit alinement.com/advisors to learn more about the tools and resources we’re building for the advisory community.