Microsoft’s disruption of a cybercrime service called EvilTokens is a reminder that payment controls need to withstand more than a badly written scam email. In a September 22 account of the operation, the company said the service could analyze compromised inboxes to identify trusted contacts, financial discussions and opportunities for impersonation.
Microsoft linked the service to more than 12,000 compromised inboxes at over 10,000 organizations worldwide. It said it and partners seized 50 websites and disabled more than 150 additional domains. Those are Microsoft’s findings. The disruption does not establish that every compromised account has been secured or that a similar approach cannot be used elsewhere.
A familiar message is not independent confirmation
For an owner or manager, the practical implication is straightforward: an email containing accurate background information can still carry an unauthorized payment request. If an attacker has access to genuine correspondence, references to colleagues, projects or earlier discussions may provide less reassurance than they appear to.
A useful response is to examine the point where a request becomes a payment instruction. Who can ask for new bank details to be entered? Who checks that request? Which contact route is used for confirmation? These questions can be answered without expecting every employee to become a security specialist.
Put the check outside the conversation
Consider a hypothetical supplier asking by email for payment to a new account. A sensible verification process uses a contact route the business already trusts, rather than a telephone number introduced in that same message. Record who confirmed the change and who approved it before the payment is released.
This is a proposed business practice, not a claim that a particular company in the incident lacked it. The point is to make the control independent of the channel an attacker might already control. A process that asks a second employee to reread the same persuasive message may not provide that independence.
Treat account recovery as a technical task
Microsoft says the operation used device-code phishing to obtain account access through legitimate authentication pages. It warns that access could persist after a password reset if associated sessions and tokens were not revoked. An affected organization should therefore involve its account administrator or security provider rather than treating a changed password as the whole recovery process.
For managers, preparation means knowing who can act and how to reach them. Keep that contact route available outside the account that might be compromised. A short, rehearsed escalation path is more useful during an incident than an impressive policy nobody can find.
Make controls workable under pressure
Test your payment process with a fictional urgent request and ask staff to explain what they would do. Look for bottlenecks, unclear ownership or pressure to bypass a check. The purpose is to improve the process, not to embarrass someone who asks for help.
Our guide to counting AI checking work emphasized the human effort behind automation. This case presents another management question: whether the business has made verification practical when a message sounds convincing and the requester appears familiar.
Illustrative business paperwork; not records from a fraud investigation. Photo: RDNE Stock project / Pexels.
