Man-in-the-middle attack

What it means

A man-in-the-middle attack is one in which an attacker secretly inserts themselves into communication between two parties. Both sides believe they are talking directly to each other, but the attacker reads the messages and can alter them, for example by swapping the bank account number on an invoice.

Technically it may involve eavesdropping on an unsecured Wi-Fi network, a fake access point in a café, a spoofed website or redirected traffic. In business it is often combined with business email compromise, where the attacker gains access to a mailbox and monitors invoicing correspondence.

The main defences are encryption of communication and verifying who you are really dealing with. An encrypted connection with a valid SSL/TLS certificate prevents data from being read or changed in transit, provided the browser verifies the certificate and the user does not ignore warnings.

How it works in practice

The biggest financial risk for businesses is a change of payment details. The attacker sends an invoice or email that looks as if it comes from a known supplier, announcing a new bank account. Any change of account must be verified by phone on a number the company already knows, not one taken from the email.

When travelling or on public networks, use a VPN and avoid unsecured Wi-Fi when working with the bank or accounting system. Two-factor authentication makes it harder for an attacker to misuse a stolen password, even if they intercept it.

For email, domain authentication records that make sender spoofing harder help, as does training staff to notice small differences in addresses. An internal four-eyes rule for changing a supplier's bank account significantly reduces the risk of fraud.

What to watch out for

Never ignore a browser warning about an invalid certificate; it may mean someone is trying to intercept the connection. Online banking and company systems should be opened via a saved bookmark, not via links in emails, which may lead to a phishing copy.

If the company pays into a fraudulent account, contact the bank immediately, as it may be able to stop the payment, and report the crime to the police. For accounting and tax purposes it is a loss, not settlement of the liability, and the genuine supplier is still entitled to payment unless it was at fault.