A property manager stops a vendor-portal account takeover that tried to redirect owner distributions, with MFA enforcement, a change-hold and a callback
A property management company of about 70 staff handling accounting for roughly 90 owner entities and 400 vendors, a leader in its segment.
- Scale
- About 70 staff, 90 owner entities, 400 vendor and owner accounts on the portal, 1 attempted redirect, 0 payments sent to the attacker
- Engagement
- Three days of incident response, then six weeks to harden the portal and the payment-change process
The challenge
The firm ran a web portal where vendors and owners maintained their own payee and bank details, and staff used the same portal to approve payments. Passwords were the only protection on most outside accounts. A vendor's login, reused from another site, was tried by an attacker, who signed in and then used the portal's own screens to change the deposit account of a large owner entity ahead of the quarterly distribution. The change looked like any other routine update, and under the old process it would have taken effect immediately.
Account takeover aimed at a payment portal is a quiet crime. There is no ransom note and no outage. A valid login makes a normal-looking change to a bank account, and the money moves on the next scheduled run. For a property manager that run is the owner distribution, so the change is made just before the largest payment of the quarter.
The first hours of the response were about evidence and containment. Lock the account, end every session, reverse the change, and keep the portal's audit trail, sign-in records and mail logs with their times intact for the bank and counsel. Only then does it make sense to ask how the attacker got in. Here the answer was a reused password, which is the most ordinary answer there is.
The fix is not one control but three that cover each other. A second factor makes a stolen password insufficient on its own. A change-hold means a new bank account cannot receive money immediately, which turns an urgent request into a scheduled one. A callback to a number already on file means that someone who has not been fooled gets to decide. The attacker has to beat all three, and each is cheap for the firm to run.
The cost is friction, and it is worth stating openly. Legitimate vendors who change banks wait a few days and take a call. The firm explained why to its vendors rather than hiding it, and treated the hold as a payment control, not a data-entry rule. In this illustrative case the callback to the real owner's representative is the moment the whole process earned its keep.
What our team delivered
- Containment and review: the takeover was found when a login from an unfamiliar country and device pattern was matched against the new bank details. The account was locked, sessions were revoked, the change was reversed and the portal's audit log, sign-in records and email logs were preserved with times recorded for counsel and the bank
- Multi-factor authentication enforced for every staff, vendor and owner account, with no exceptions for convenience. Staff use passkeys or hardware keys, outside users can choose an authenticator app or passkey, and a text message is accepted only as a last resort. Accounts without an enrolled factor cannot sign in
- A change-hold on every banking change: new account details cannot be used for a payment until a hold of three business days has passed and a callback is complete. The hold runs on a calendar, not a mood, so a rushed email from someone claiming to be the owner does not shorten it
- A callback to the telephone number already on file, never the number in the request, by someone other than the person who entered the change, with the result noted on the change record. When the firm called the number on file, the real owner's representative said no change had been requested
- Notification of the old email address and phone number whenever banking details change, so the real account holder hears about it first
- Sign-in alerts for a new device, a new network or country, a password reset followed by a banking change, and several accounts signing in from the same address. Passwords are checked against known breached lists, and repeated failures slow down instead of locking out the real user
- Short training for the accounting team on why a banking change is a payment control and not a data-entry task, and a quarterly review of the change log, covering how many changes were requested, held, called back and rejected
Result
No distribution was sent to the attacker. The redirect was stopped at the hold, the callback confirmed it was fraud, and the owner entity's real details were never overwritten in the bank file. Over the next quarter the portal blocked 11 sign-in attempts from unfamiliar devices, and every vendor and owner account had a second factor within six weeks. The change-hold added a few days to legitimate banking updates, which the firm accepted and explained to its vendors. That is one illustrative outcome, not a promise: a stolen phone with a registered factor or a vendor who is truly compromised can still pass a check, which is why the callback uses a number already on file. This is an illustrative engagement that describes the kind of work our team does; details are composite.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Show 3 more
Insurance-ready bundle
The three things cyber insurers and clients ask for most: an external assessment, a phishing simulation for 25 users and a disaster recovery plan.
Assessment report in 5 business days; plan draft in 15 business days
$5,400 per bundle, phishing simulation for 25 users
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
Phishing simulation
A realistic, authorized phishing campaign with short training for anyone who clicks. Priced per person.
Campaign launches within 5 business days of approval
$12 per user, per campaign
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Payment-change callback flow
A request to change bank details is never acted on from the request itself. Someone rings the number already on file, a second person approves, the outcome is written down, and only then is the payment released or held. If any step fails, the old details stay in use.
Five million events, three escalations
What a managed SOC does to a day of log volume for a 250‑seat organisation. Collection produces millions of events; correlation rules turn them into a thousand or so alerts; triage merges and dismisses most of those into dozens of incidents; only a few need a human on the customer side. Bar length is the logarithm of the count, so each step is orders of magnitude. Illustrative figures.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.