The Email Your Client Will Send You After Your Breach — Before You Even Know It Happened
Thought Leadership Financial Impact
In many SMB breaches, the business owner doesn't find out from their security team. They find out from a client who received a phishing email that appeared to come from them, lost money because of it, and wants to know what happened. That conversation — after the fact, without warning, at full financial exposure — is one of the most damaging moments a small business can face.
It's 9:17am on a Wednesday. You're on your second coffee, answering emails, when one arrives from a client you've worked with for four years. The subject line reads: "Did you send this?"
They've forwarded you an email that appears to come from your address — your name, your logo, your email domain — asking them to update their payment details for an invoice. They paid it. The payment went to an account you've never seen. They want to know if you authorized it, and whether their other financial details are safe.
You didn't send the email. You had no idea your domain was being used this way. And you're now in a conversation you have no script for — with a client who has lost real money because of a security gap in your business that you never knew existed.
This scenario plays out in small businesses across the country every week. Business email compromise cost businesses $16.6 billion in 2024 — more than ransomware, data breaches, and every other cybercrime category combined, according to FBI IC3 data. And the defining feature of almost every case is the same: the business whose domain was spoofed or compromised found out from their client, not from their own security monitoring.
The three ways your client finds out before you do
There are three distinct scenarios through which a client discovers your breach before you do. Each carries its own financial and legal exposure. Each has a specific technical gap that made it possible.
Scenario 1 — Your domain is being spoofed
Your client received an email that appeared to come from you. You never sent it.An attacker researched your business — your name, your email format, your client relationships, visible from your website and LinkedIn — and sent your client a targeted email that appeared to come from your domain. No malware. No hacked account. Just a spoofed sender address exploiting the fact that your domain has no DMARC enforcement in place.
Your client received what looked like an email from you requesting a payment update, an invoice, or sensitive information. They acted on it. By the time they forwarded it asking "did you send this?" the money or data is already gone.
Scenario 2 — Your email account was compromised
The attacker was sending from your real inbox. The emails were completely legitimate-looking.An attacker obtained your email credentials and gained access to your actual inbox. They read months of correspondence to understand your clients, your projects, your payment processes, and your writing style. Then they inserted themselves into active conversations, intercepting invoices and redirecting payments.
When your client received the email, it came from your actual email address. The writing style matched. The context matched. There was nothing to flag it as suspicious — because technically, it was sent from your account. The attacker monitored your inbox for weeks without you knowing.
Scenario 3 — Your client's data appeared somewhere it shouldn't
A client contacts you after finding their information on a dark web marketplace or breach notification.Your client received a notification — from HaveIBeenPwned, from their identity monitoring service, or from a credit bureau — that their personal details appeared in a data breach traced back to your systems. Client names, email addresses, contact details, or payment information you held on their behalf was exfiltrated in a breach you hadn't yet detected.
63% of all data breaches tracked since January 2025 involved small and mid-sized businesses. Many of those businesses discovered the breach only after affected individuals surfaced the exposed data. The client calling to ask about their information is frequently the first notification the business receives.
The email that reveals your liability — whether you're ready for it or not
Here is the email you don't want to receive. It's a composite of documented BEC incident patterns.
Hi,
I hope I'm catching you quickly on this. We received an invoice from your email address last week requesting we update our payment details for the Q2 retainer. The email looked exactly like your previous invoices — your logo, your signature, your email address — so our finance team processed it on Thursday.
The payment went out for $18,500. I was reviewing accounts today and something looked off, so I pulled the original email. The bank details were different from what we've always used for you.
Can you please confirm whether you sent this and whether the bank account details were legitimate? If not, we need to know immediately what information of ours you hold and whether it may have been compromised.
We've contacted our bank to try to recall the payment, but they've told us recovery at this point is unlikely.
I'll be honest — we're very concerned. We've worked together for four years and this is not what we expected. We need answers today.
— Sarah
That email is a financial loss you didn't cause and can't immediately recover. It's a client relationship under maximum stress with no preparation time. It's a legal question about your liability for a payment made based on your spoofed or compromised email address. And it's the beginning of a conversation you are completely unprepared for.
What determines whether this happens to your business
The difference between businesses that receive that email and businesses that don't comes down to three technical controls — all checkable in under 30 minutes using free tools, and none requiring a security team to implement.
DMARC enforcement. Without DMARC set to p=quarantine or p=reject, anyone can send an email that appears to come from your domain. Checking your DMARC record takes 60 seconds at mxtoolbox.com. Moving from p=none to p=reject closes Scenario 1 entirely. Over half of all domains with DMARC are still at p=none — very likely including yours.
MFA on every email account, enforced. Not available — enforced. Not on most accounts — all of them. Scenario 2 requires access to your actual email account. MFA with number matching makes that access dramatically harder to obtain. Partial MFA leaves the specific accounts attackers target most exposed.
Credential monitoring. If your email credentials have appeared in a breach database, attackers may already be testing them. Continuous monitoring of your domain against known breach databases gives you the window to change credentials before the access happens. Scenario 2 starts with credentials. Monitoring closes the window at the source.
The conversation you'll wish you'd never had to have
When your client calls or emails to say they received something suspicious from your address, there is no good version of that conversation. There is the version where you can say "we had controls in place and are investigating how this happened despite them." And there is the version where you have to say "we weren't monitoring for this and we didn't know."
The first version is recoverable. The second version is where client relationships end, where legal exposure begins, and where the 38% customer churn that follows a breach starts its slow, quiet accumulation.
Your client's email will tell you what your security posture actually is — not what you hoped it was. The only question is whether you find out that way, or whether you find out first.
📚 Credential Security Series — Read the full series
Know what attackers see when they look at your domain — before your client does. Veriti Spottr's beta is free.
Join the free beta →
Comments
Post a Comment